Vulnerability-Lookup

CVE-2025-13888 (GCVE-0-2025-13888)

Vulnerability from cvelistv5 – Published: 2025-12-15 15:36 – Updated: 2026-01-22 15:50

Title

Openshift-gitops-operator: openshift gitops: namespace admin cluster takeover via privileged jobs

Summary

A flaw was found in OpenShift GitOps. Namespace admins can create ArgoCD Custom Resources (CRs) that trick the system into granting them elevated permissions in other namespaces, including privileged namespaces. An authenticated attacker can then use these elevated permissions to create privileged workloads that run on master nodes, effectively giving them root access to the entire cluster.

Severity

9.1 (Critical)


                        
                          CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2025-12-15 15:48 UTC

CWE

CWE-266 - Incorrect Privilege Assignment

Assigner

redhat redhat root

References

9 references

URL	Tags
https://access.redhat.com/errata/RHSA-2025:23203	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2025:23206	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2025:23207	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:1017	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/security/cve/CVE-2025-13888	vdb-entryx_refsource_REDHAT
https://bugzilla.redhat.com/show_bug.cgi?id=2418361	issue-trackingx_refsource_REDHAT
https://github.com/redhat-developer/gitops-operat…
https://github.com/redhat-developer/gitops-operat…
https://github.com/redhat-developer/gitops-operat…

Impacted products

6 products

Vendor	Product	Version	CPE status
redhat-developer	gitops-operator	Affected: 0 , < 1.16.2 (semver)	guessed
Red Hat	Red Hat OpenShift GitOps 1.16	Unaffected: sha256:c41c99f360a2515bce55c42e309e2c72500ba66d3a2c461412dee7de5ea9a9fa , < * (rpm) cpe:/a:redhat:openshift_gitops:1.16::el8
Red Hat	Red Hat OpenShift GitOps 1.17	Unaffected: sha256:27e7a59bb5c5f60be7509e5f4f07f4181d62e6583a943c46f56f568bfc30c2c1 , < * (rpm) cpe:/a:redhat:openshift_gitops:1.17::el8
Red Hat	Red Hat OpenShift GitOps 1.18	Unaffected: sha256:3eb6308c58365182b4b5b5aabf35754d821e25b8a04b0595900fb47d52cd3ecc , < * (rpm) cpe:/a:redhat:openshift_gitops:1.18::el8
Red Hat	Red Hat OpenShift GitOps 1.18	Unaffected: sha256:43ba408b8ed58259bf338fd29260d936fbde9846f772d0580b3e7486ef8ea300 , < * (rpm) cpe:/a:redhat:openshift_gitops:1.18::el8
Red Hat	Red Hat OpenShift GitOps	cpe:/a:redhat:openshift_gitops:1

Date Public

2025-12-15 13:00

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-13888",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-12-15T15:48:48.698397Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-12-15T15:50:21.160Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://github.com/redhat-developer/gitops-operator",
          "defaultStatus": "unaffected",
          "packageName": "gitops-operator",
          "product": "gitops-operator",
          "vendor": "redhat-developer",
          "versions": [
            {
              "lessThan": "1.16.2",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "collectionURL": "https://catalog.redhat.com/software/containers/",
          "cpes": [
            "cpe:/a:redhat:openshift_gitops:1.16::el8"
          ],
          "defaultStatus": "affected",
          "packageName": "openshift-gitops-1/gitops-rhel8-operator",
          "product": "Red Hat OpenShift GitOps 1.16",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "sha256:c41c99f360a2515bce55c42e309e2c72500ba66d3a2c461412dee7de5ea9a9fa",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://catalog.redhat.com/software/containers/",
          "cpes": [
            "cpe:/a:redhat:openshift_gitops:1.17::el8"
          ],
          "defaultStatus": "affected",
          "packageName": "openshift-gitops-1/gitops-rhel8-operator",
          "product": "Red Hat OpenShift GitOps 1.17",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "sha256:27e7a59bb5c5f60be7509e5f4f07f4181d62e6583a943c46f56f568bfc30c2c1",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://catalog.redhat.com/software/containers/",
          "cpes": [
            "cpe:/a:redhat:openshift_gitops:1.18::el8"
          ],
          "defaultStatus": "affected",
          "packageName": "openshift-gitops-1/gitops-rhel8-operator",
          "product": "Red Hat OpenShift GitOps 1.18",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "sha256:3eb6308c58365182b4b5b5aabf35754d821e25b8a04b0595900fb47d52cd3ecc",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://catalog.redhat.com/software/containers/",
          "cpes": [
            "cpe:/a:redhat:openshift_gitops:1.18::el8"
          ],
          "defaultStatus": "affected",
          "packageName": "openshift-gitops-1/gitops-rhel8-operator",
          "product": "Red Hat OpenShift GitOps 1.18",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "sha256:43ba408b8ed58259bf338fd29260d936fbde9846f772d0580b3e7486ef8ea300",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:openshift_gitops:1"
          ],
          "defaultStatus": "unaffected",
          "packageName": "openshift-gitops-1/gitops-operator-bundle",
          "product": "Red Hat OpenShift GitOps",
          "vendor": "Red Hat"
        }
      ],
      "datePublic": "2025-12-15T13:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "A flaw was found in OpenShift GitOps. Namespace admins can create ArgoCD Custom Resources (CRs) that trick the system into granting them elevated permissions in other namespaces, including privileged namespaces. An authenticated attacker can then use these elevated permissions to create privileged workloads that run on master nodes, effectively giving them root access to the entire cluster."
        }
      ],
      "metrics": [
        {
          "other": {
            "content": {
              "namespace": "https://access.redhat.com/security/updates/classification/",
              "value": "Important"
            },
            "type": "Red Hat severity rating"
          }
        },
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 9.1,
            "baseSeverity": "CRITICAL",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "HIGH",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-266",
              "description": "Incorrect Privilege Assignment",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-01-22T15:50:50.274Z",
        "orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
        "shortName": "redhat"
      },
      "references": [
        {
          "name": "RHSA-2025:23203",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2025:23203"
        },
        {
          "name": "RHSA-2025:23206",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2025:23206"
        },
        {
          "name": "RHSA-2025:23207",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2025:23207"
        },
        {
          "name": "RHSA-2026:1017",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2026:1017"
        },
        {
          "tags": [
            "vdb-entry",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/security/cve/CVE-2025-13888"
        },
        {
          "name": "RHBZ#2418361",
          "tags": [
            "issue-tracking",
            "x_refsource_REDHAT"
          ],
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2418361"
        },
        {
          "url": "https://github.com/redhat-developer/gitops-operator/commit/bc6ac3e03d7c8b3db5d8f1770c868396a4c2dcef"
        },
        {
          "url": "https://github.com/redhat-developer/gitops-operator/pull/897"
        },
        {
          "url": "https://github.com/redhat-developer/gitops-operator/releases/tag/v1.16.2"
        }
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2025-12-02T00:00:00.000Z",
          "value": "Reported to Red Hat."
        },
        {
          "lang": "en",
          "time": "2025-12-15T13:00:00.000Z",
          "value": "Made public."
        }
      ],
      "title": "Openshift-gitops-operator: openshift gitops: namespace admin cluster takeover via privileged jobs",
      "x_generator": {
        "engine": "cvelib 1.8.0"
      },
      "x_redhatCweChain": "CWE-266: Incorrect Privilege Assignment"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
    "assignerShortName": "redhat",
    "cveId": "CVE-2025-13888",
    "datePublished": "2025-12-15T15:36:49.274Z",
    "dateReserved": "2025-12-02T15:18:16.323Z",
    "dateUpdated": "2026-01-22T15:50:50.274Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2025-13888",
      "date": "2026-09-14",
      "epss": "0.00685",
      "percentile": "0.5067"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2025-13888\",\"sourceIdentifier\":\"secalert@redhat.com\",\"published\":\"2025-12-15T16:15:50.333\",\"lastModified\":\"2026-06-17T08:34:55.720\",\"vulnStatus\":\"Deferred\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"A flaw was found in OpenShift GitOps. Namespace admins can create ArgoCD Custom Resources (CRs) that trick the system into granting them elevated permissions in other namespaces, including privileged namespaces. An authenticated attacker can then use these elevated permissions to create privileged workloads that run on master nodes, effectively giving them root access to the entire cluster.\"}],\"affected\":[{\"source\":\"secalert@redhat.com\",\"affectedData\":[{\"vendor\":\"redhat-developer\",\"product\":\"gitops-operator\",\"defaultStatus\":\"unaffected\",\"collectionURL\":\"https://github.com/redhat-developer/gitops-operator\",\"packageName\":\"gitops-operator\",\"versions\":[{\"version\":\"0\",\"lessThan\":\"1.16.2\",\"versionType\":\"semver\",\"status\":\"affected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat OpenShift GitOps 1.16\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://catalog.redhat.com/software/containers/\",\"packageName\":\"openshift-gitops-1/gitops-rhel8-operator\",\"cpes\":[\"cpe:/a:redhat:openshift_gitops:1.16::el8\"],\"versions\":[{\"version\":\"sha256:c41c99f360a2515bce55c42e309e2c72500ba66d3a2c461412dee7de5ea9a9fa\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat OpenShift GitOps 1.17\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://catalog.redhat.com/software/containers/\",\"packageName\":\"openshift-gitops-1/gitops-rhel8-operator\",\"cpes\":[\"cpe:/a:redhat:openshift_gitops:1.17::el8\"],\"versions\":[{\"version\":\"sha256:27e7a59bb5c5f60be7509e5f4f07f4181d62e6583a943c46f56f568bfc30c2c1\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat OpenShift GitOps 1.18\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://catalog.redhat.com/software/containers/\",\"packageName\":\"openshift-gitops-1/gitops-rhel8-operator\",\"cpes\":[\"cpe:/a:redhat:openshift_gitops:1.18::el8\"],\"versions\":[{\"version\":\"sha256:3eb6308c58365182b4b5b5aabf35754d821e25b8a04b0595900fb47d52cd3ecc\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat OpenShift GitOps 1.18\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://catalog.redhat.com/software/containers/\",\"packageName\":\"openshift-gitops-1/gitops-rhel8-operator\",\"cpes\":[\"cpe:/a:redhat:openshift_gitops:1.18::el8\"],\"versions\":[{\"version\":\"sha256:43ba408b8ed58259bf338fd29260d936fbde9846f772d0580b3e7486ef8ea300\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat OpenShift GitOps\",\"defaultStatus\":\"unaffected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"openshift-gitops-1/gitops-operator-bundle\",\"cpes\":[\"cpe:/a:redhat:openshift_gitops:1\"]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"secalert@redhat.com\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H\",\"baseScore\":9.1,\"baseSeverity\":\"CRITICAL\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"HIGH\",\"userInteraction\":\"NONE\",\"scope\":\"CHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":2.3,\"impactScore\":6.0}],\"ssvcV203\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"ssvcData\":{\"timestamp\":\"2025-12-15T15:48:48.698397Z\",\"id\":\"CVE-2025-13888\",\"options\":[{\"exploitation\":\"none\"},{\"automatable\":\"no\"},{\"technicalImpact\":\"total\"}],\"role\":\"CISA Coordinator\",\"version\":\"2.0.3\"}}]},\"weaknesses\":[{\"source\":\"secalert@redhat.com\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-266\"}]}],\"references\":[{\"url\":\"https://access.redhat.com/errata/RHSA-2025:23203\",\"source\":\"secalert@redhat.com\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2025:23206\",\"source\":\"secalert@redhat.com\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2025:23207\",\"source\":\"secalert@redhat.com\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:1017\",\"source\":\"secalert@redhat.com\"},{\"url\":\"https://access.redhat.com/security/cve/CVE-2025-13888\",\"source\":\"secalert@redhat.com\"},{\"url\":\"https://bugzilla.redhat.com/show_bug.cgi?id=2418361\",\"source\":\"secalert@redhat.com\"},{\"url\":\"https://github.com/redhat-developer/gitops-operator/commit/bc6ac3e03d7c8b3db5d8f1770c868396a4c2dcef\",\"source\":\"secalert@redhat.com\"},{\"url\":\"https://github.com/redhat-developer/gitops-operator/pull/897\",\"source\":\"secalert@redhat.com\"},{\"url\":\"https://github.com/redhat-developer/gitops-operator/releases/tag/v1.16.2\",\"source\":\"secalert@redhat.com\"}]}}",
    "redhat_vex": {
      "aggregate_severity": "Important",
      "current_release_date": "2026-07-11T17:40:59+00:00",
      "cve": "CVE-2025-13888",
      "id": "CVE-2025-13888",
      "initial_release_date": "2025-12-15T13:00:00+00:00",
      "product_status:fixed": "16",
      "product_status:known_not_affected": "145",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "openshift-gitops-operator: OpenShift GitOps: Namespace Admin Cluster Takeover via Privileged Jobs",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-13888.json",
      "version": "3"
    },
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2025-13888\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"total\"}], \"version\": \"2.0.3\", \"timestamp\": \"2025-12-15T15:48:48.698397Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2025-12-15T15:50:13.357Z\"}}], \"cna\": {\"title\": \"Openshift-gitops-operator: openshift gitops: namespace admin cluster takeover via privileged jobs\", \"metrics\": [{\"other\": {\"type\": \"Red Hat severity rating\", \"content\": {\"value\": \"Important\", \"namespace\": \"https://access.redhat.com/security/updates/classification/\"}}}, {\"format\": \"CVSS\", \"cvssV3_1\": {\"scope\": \"CHANGED\", \"version\": \"3.1\", \"baseScore\": 9.1, \"attackVector\": \"NETWORK\", \"baseSeverity\": \"CRITICAL\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H\", \"integrityImpact\": \"HIGH\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"LOW\", \"availabilityImpact\": \"HIGH\", \"privilegesRequired\": \"HIGH\", \"confidentialityImpact\": \"HIGH\"}}], \"affected\": [{\"vendor\": \"redhat-developer\", \"product\": \"gitops-operator\", \"versions\": [{\"status\": \"affected\", \"version\": \"0\", \"lessThan\": \"1.16.2\", \"versionType\": \"semver\"}], \"packageName\": \"gitops-operator\", \"collectionURL\": \"https://github.com/redhat-developer/gitops-operator\", \"defaultStatus\": \"unaffected\"}, {\"cpes\": [\"cpe:/a:redhat:openshift_gitops:1.16::el8\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat OpenShift GitOps 1.16\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"sha256:c41c99f360a2515bce55c42e309e2c72500ba66d3a2c461412dee7de5ea9a9fa\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}], \"packageName\": \"openshift-gitops-1/gitops-rhel8-operator\", \"collectionURL\": \"https://catalog.redhat.com/software/containers/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:openshift_gitops:1.17::el8\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat OpenShift GitOps 1.17\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"sha256:27e7a59bb5c5f60be7509e5f4f07f4181d62e6583a943c46f56f568bfc30c2c1\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}], \"packageName\": \"openshift-gitops-1/gitops-rhel8-operator\", \"collectionURL\": \"https://catalog.redhat.com/software/containers/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:openshift_gitops:1.18::el8\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat OpenShift GitOps 1.18\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"sha256:3eb6308c58365182b4b5b5aabf35754d821e25b8a04b0595900fb47d52cd3ecc\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}], \"packageName\": \"openshift-gitops-1/gitops-rhel8-operator\", \"collectionURL\": \"https://catalog.redhat.com/software/containers/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:openshift_gitops:1.18::el8\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat OpenShift GitOps 1.18\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"sha256:43ba408b8ed58259bf338fd29260d936fbde9846f772d0580b3e7486ef8ea300\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}], \"packageName\": \"openshift-gitops-1/gitops-rhel8-operator\", \"collectionURL\": \"https://catalog.redhat.com/software/containers/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:openshift_gitops:1\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat OpenShift GitOps\", \"packageName\": \"openshift-gitops-1/gitops-operator-bundle\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"unaffected\"}], \"timeline\": [{\"lang\": \"en\", \"time\": \"2025-12-02T00:00:00+00:00\", \"value\": \"Reported to Red Hat.\"}, {\"lang\": \"en\", \"time\": \"2025-12-15T13:00:00+00:00\", \"value\": \"Made public.\"}], \"datePublic\": \"2025-12-15T13:00:00.000Z\", \"references\": [{\"url\": \"https://access.redhat.com/errata/RHSA-2025:23203\", \"name\": \"RHSA-2025:23203\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2025:23206\", \"name\": \"RHSA-2025:23206\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2025:23207\", \"name\": \"RHSA-2025:23207\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:1017\", \"name\": \"RHSA-2026:1017\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/security/cve/CVE-2025-13888\", \"tags\": [\"vdb-entry\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://bugzilla.redhat.com/show_bug.cgi?id=2418361\", \"name\": \"RHBZ#2418361\", \"tags\": [\"issue-tracking\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://github.com/redhat-developer/gitops-operator/commit/bc6ac3e03d7c8b3db5d8f1770c868396a4c2dcef\"}, {\"url\": \"https://github.com/redhat-developer/gitops-operator/pull/897\"}, {\"url\": \"https://github.com/redhat-developer/gitops-operator/releases/tag/v1.16.2\"}], \"x_generator\": {\"engine\": \"cvelib 1.8.0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"A flaw was found in OpenShift GitOps. Namespace admins can create ArgoCD Custom Resources (CRs) that trick the system into granting them elevated permissions in other namespaces, including privileged namespaces. An authenticated attacker can then use these elevated permissions to create privileged workloads that run on master nodes, effectively giving them root access to the entire cluster.\"}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-266\", \"description\": \"Incorrect Privilege Assignment\"}]}], \"providerMetadata\": {\"orgId\": \"53f830b8-0a3f-465b-8143-3b8a9948e749\", \"shortName\": \"redhat\", \"dateUpdated\": \"2026-01-22T15:50:50.274Z\"}, \"x_redhatCweChain\": \"CWE-266: Incorrect Privilege Assignment\"}}",
      "cveMetadata": "{\"cveId\": \"CVE-2025-13888\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-01-22T15:50:50.274Z\", \"dateReserved\": \"2025-12-02T15:18:16.323Z\", \"assignerOrgId\": \"53f830b8-0a3f-465b-8143-3b8a9948e749\", \"datePublished\": \"2025-12-15T15:36:49.274Z\", \"assignerShortName\": \"redhat\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}

FKIE_CVE-2025-13888

Vulnerability from fkie_nvd - Published: 2025-12-15 16:15 - Updated: 2026-06-17 08:34

Severity

9.1 (Critical) - CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

Summary

References

	URL	Tags
	secalert@redhat.com	https://access.redhat.com/errata/RHSA-2025:23203
	secalert@redhat.com	https://access.redhat.com/errata/RHSA-2025:23206
	secalert@redhat.com	https://access.redhat.com/errata/RHSA-2025:23207
	secalert@redhat.com	https://access.redhat.com/errata/RHSA-2026:1017
	secalert@redhat.com	https://access.redhat.com/security/cve/CVE-2025-13888
	secalert@redhat.com	https://bugzilla.redhat.com/show_bug.cgi?id=2418361
	secalert@redhat.com	https://github.com/redhat-developer/gitops-operator/commit/bc6ac3e03d7c8b3db5d8f1770c868396a4c2dcef
	secalert@redhat.com	https://github.com/redhat-developer/gitops-operator/pull/897
	secalert@redhat.com	https://github.com/redhat-developer/gitops-operator/releases/tag/v1.16.2

Impacted products

	Vendor	Product	Version

JSON

To clipboard

{
  "affected": [
    {
      "affectedData": [
        {
          "collectionURL": "https://github.com/redhat-developer/gitops-operator",
          "defaultStatus": "unaffected",
          "packageName": "gitops-operator",
          "product": "gitops-operator",
          "vendor": "redhat-developer",
          "versions": [
            {
              "lessThan": "1.16.2",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "collectionURL": "https://catalog.redhat.com/software/containers/",
          "cpes": [
            "cpe:/a:redhat:openshift_gitops:1.16::el8"
          ],
          "defaultStatus": "affected",
          "packageName": "openshift-gitops-1/gitops-rhel8-operator",
          "product": "Red Hat OpenShift GitOps 1.16",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "sha256:c41c99f360a2515bce55c42e309e2c72500ba66d3a2c461412dee7de5ea9a9fa",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://catalog.redhat.com/software/containers/",
          "cpes": [
            "cpe:/a:redhat:openshift_gitops:1.17::el8"
          ],
          "defaultStatus": "affected",
          "packageName": "openshift-gitops-1/gitops-rhel8-operator",
          "product": "Red Hat OpenShift GitOps 1.17",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "sha256:27e7a59bb5c5f60be7509e5f4f07f4181d62e6583a943c46f56f568bfc30c2c1",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://catalog.redhat.com/software/containers/",
          "cpes": [
            "cpe:/a:redhat:openshift_gitops:1.18::el8"
          ],
          "defaultStatus": "affected",
          "packageName": "openshift-gitops-1/gitops-rhel8-operator",
          "product": "Red Hat OpenShift GitOps 1.18",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "sha256:3eb6308c58365182b4b5b5aabf35754d821e25b8a04b0595900fb47d52cd3ecc",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://catalog.redhat.com/software/containers/",
          "cpes": [
            "cpe:/a:redhat:openshift_gitops:1.18::el8"
          ],
          "defaultStatus": "affected",
          "packageName": "openshift-gitops-1/gitops-rhel8-operator",
          "product": "Red Hat OpenShift GitOps 1.18",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "sha256:43ba408b8ed58259bf338fd29260d936fbde9846f772d0580b3e7486ef8ea300",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:openshift_gitops:1"
          ],
          "defaultStatus": "unaffected",
          "packageName": "openshift-gitops-1/gitops-operator-bundle",
          "product": "Red Hat OpenShift GitOps",
          "vendor": "Red Hat"
        }
      ],
      "source": "secalert@redhat.com"
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "A flaw was found in OpenShift GitOps. Namespace admins can create ArgoCD Custom Resources (CRs) that trick the system into granting them elevated permissions in other namespaces, including privileged namespaces. An authenticated attacker can then use these elevated permissions to create privileged workloads that run on master nodes, effectively giving them root access to the entire cluster."
    }
  ],
  "id": "CVE-2025-13888",
  "lastModified": "2026-06-17T08:34:55.720",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "HIGH",
          "baseScore": 9.1,
          "baseSeverity": "CRITICAL",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "privilegesRequired": "HIGH",
          "scope": "CHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 2.3,
        "impactScore": 6.0,
        "source": "secalert@redhat.com",
        "type": "Secondary"
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2025-13888",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "role": "CISA Coordinator",
          "timestamp": "2025-12-15T15:48:48.698397Z",
          "version": "2.0.3"
        }
      }
    ]
  },
  "published": "2025-12-15T16:15:50.333",
  "references": [
    {
      "source": "secalert@redhat.com",
      "url": "https://access.redhat.com/errata/RHSA-2025:23203"
    },
    {
      "source": "secalert@redhat.com",
      "url": "https://access.redhat.com/errata/RHSA-2025:23206"
    },
    {
      "source": "secalert@redhat.com",
      "url": "https://access.redhat.com/errata/RHSA-2025:23207"
    },
    {
      "source": "secalert@redhat.com",
      "url": "https://access.redhat.com/errata/RHSA-2026:1017"
    },
    {
      "source": "secalert@redhat.com",
      "url": "https://access.redhat.com/security/cve/CVE-2025-13888"
    },
    {
      "source": "secalert@redhat.com",
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2418361"
    },
    {
      "source": "secalert@redhat.com",
      "url": "https://github.com/redhat-developer/gitops-operator/commit/bc6ac3e03d7c8b3db5d8f1770c868396a4c2dcef"
    },
    {
      "source": "secalert@redhat.com",
      "url": "https://github.com/redhat-developer/gitops-operator/pull/897"
    },
    {
      "source": "secalert@redhat.com",
      "url": "https://github.com/redhat-developer/gitops-operator/releases/tag/v1.16.2"
    }
  ],
  "sourceIdentifier": "secalert@redhat.com",
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-266"
        }
      ],
      "source": "secalert@redhat.com",
      "type": "Secondary"
    }
  ]
}

GHSA-PCQX-8QWW-7F4V

Vulnerability from github – Published: 2025-12-15 18:30 – Updated: 2026-01-22 18:30

Summary

OpenShift GitOps authenticated attackers can obtain cluster root access through forged ArgoCD custom resources

Details

Severity

9.1 (Critical)


                  
                    CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "Go",
        "name": "github.com/redhat-developer/gitops-operator"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.16.2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2025-13888"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-266"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2025-12-16T20:11:04Z",
    "nvd_published_at": "2025-12-15T16:15:50Z",
    "severity": "CRITICAL"
  },
  "details": "A flaw was found in OpenShift GitOps. Namespace admins can create ArgoCD Custom Resources (CRs) that trick the system into granting them elevated permissions in other namespaces, including privileged namespaces. An authenticated attacker can then use these elevated permissions to create privileged workloads that run on master nodes, effectively giving them root access to the entire cluster.",
  "id": "GHSA-pcqx-8qww-7f4v",
  "modified": "2026-01-22T18:30:29Z",
  "published": "2025-12-15T18:30:39Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-13888"
    },
    {
      "type": "WEB",
      "url": "https://github.com/redhat-developer/gitops-operator/pull/897"
    },
    {
      "type": "WEB",
      "url": "https://github.com/redhat-developer/gitops-operator/commit/bc6ac3e03d7c8b3db5d8f1770c868396a4c2dcef"
    },
    {
      "type": "WEB",
      "url": "https://access.redhat.com/errata/RHSA-2025:23203"
    },
    {
      "type": "WEB",
      "url": "https://access.redhat.com/errata/RHSA-2025:23206"
    },
    {
      "type": "WEB",
      "url": "https://access.redhat.com/errata/RHSA-2025:23207"
    },
    {
      "type": "WEB",
      "url": "https://access.redhat.com/errata/RHSA-2026:1017"
    },
    {
      "type": "WEB",
      "url": "https://access.redhat.com/security/cve/CVE-2025-13888"
    },
    {
      "type": "WEB",
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2418361"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/redhat-developer/gitops-operator"
    },
    {
      "type": "WEB",
      "url": "https://github.com/redhat-developer/gitops-operator/releases/tag/v1.16.2"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "OpenShift GitOps authenticated attackers can obtain cluster root access through forged ArgoCD custom resources"
}

RHSA-2025:23203

Vulnerability from csaf_redhat - Published: 2025-12-15 15:34 - Updated: 2026-09-09 22:39

Summary

Red Hat Security Advisory: Red Hat OpenShift GitOps v1.18.2 security update

Severity

Important

Scope

3 vulnerabilities in this advisory, including CVE-2025-13888.

CVE-2025-13888

9.1 (Critical)


                
                  CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

Fixed: 4 products Known not affected: 37 products

https://access.redhat.com/errata/RHSA-2025:23203

Open the full advisory

RHSA-2025:23206

Vulnerability from csaf_redhat - Published: 2025-12-15 15:39 - Updated: 2026-09-14 14:50

Summary

Red Hat Security Advisory: Red Hat OpenShift GitOps v1.17.3 security update

Severity

Important

Scope

4 vulnerabilities in this advisory, including CVE-2025-13888.

CVE-2025-13888

9.1 (Critical)


                
                  CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

Fixed: 4 products Known not affected: 37 products

https://access.redhat.com/errata/RHSA-2025:23206

Open the full advisory

RHSA-2025:23207

Vulnerability from csaf_redhat - Published: 2025-12-15 15:40 - Updated: 2026-09-14 14:50

Summary

Red Hat Security Advisory: Red Hat OpenShift GitOps v1.16.5 security update

Severity

Important

Scope

4 vulnerabilities in this advisory, including CVE-2025-13888.

CVE-2025-13888

9.1 (Critical)


                
                  CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

Fixed: 4 products Known not affected: 33 products

https://access.redhat.com/errata/RHSA-2025:23207

Open the full advisory

RHSA-2026:1017

Vulnerability from csaf_redhat - Published: 2026-01-22 15:47 - Updated: 2026-09-14 12:11

Summary

Red Hat Security Advisory: Red Hat OpenShift GitOps v1.18.3 security update

Severity

Important

Scope

6 vulnerabilities in this advisory, including CVE-2025-13888.

CVE-2025-13888

9.1 (Critical)


                
                  CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

Fixed: 4 products Known not affected: 37 products

https://access.redhat.com/errata/RHSA-2026:1017

Open the full advisory

WID-SEC-W-2025-2861

Vulnerability from csaf_certbund - Published: 2025-12-16 23:00 - Updated: 2026-01-22 23:00

Summary

Red Hat OpenShift GitOps: Schwachstelle ermöglicht Erlangen von Administratorrechten

Severity

Hoch

Scope

1 vulnerability in this advisory, including CVE-2025-13888.

CVE-2025-13888

Known affected: 4 products

Open the full advisory

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.

Action not permitted

CVE-2025-13888 (GCVE-0-2025-13888)

FKIE_CVE-2025-13888

GHSA-PCQX-8QWW-7F4V

RHSA-2025:23203

RHSA-2025:23206

RHSA-2025:23207

RHSA-2026:1017

WID-SEC-W-2025-2861

Tags

Sightings

Nomenclature