What’s Vulnerable › Vulnerabilities

CVE-2024-13484: Openshift-gitops-operator-container: namespace isolation break

• Severity: high (CVSS 8.2 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.2% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2025-01-28 · updated 2026-06-26
• Weakness: CWE-668

Description

A flaw was found in openshift-gitops-operator-container. The openshift.io/cluster-monitoring label is applied to all namespaces that deploy an ArgoCD CR instance, allowing the namespace to create a rogue PrometheusRule. This issue can have adverse effects on the platform monitoring stack, as the rule is rolled out cluster-wide when the label is applied.

Affected products

• Red Hat OpenShift GitOps 1.14: all versions — fixed in v1.14.4-1
• Red Hat OpenShift GitOps 1.15: all versions — fixed in v1.15.2-1, v1.15.2-4
• Red Hat OpenShift GitOps 1.16: all versions — fixed in 1.16

How to fix

Upgrade to a fixed version: Red Hat OpenShift GitOps 1.14 v1.14.4-1; Red Hat OpenShift GitOps 1.15 v1.15.2-1, v1.15.2-4; Red Hat OpenShift GitOps 1.16 1.16. Check the vendor advisory for mitigations.

References

• https://access.redhat.com/errata/RHSA-2025:7753
• https://access.redhat.com/errata/RHSA-2025:8274
• https://access.redhat.com/errata/RHSA-2025:9506
• https://access.redhat.com/security/cve/CVE-2024-13484
• https://bugzilla.redhat.com/show_bug.cgi?id=2269376
• https://github.com/redhat-developer/gitops-operator/pull/853
• https://github.com/redhat-developer/gitops-operator/pull/867
• https://github.com/redhat-developer/gitops-operator/pull/868
• https://github.com/redhat-developer/gitops-operator/pull/869

Get alerted when CVE-2024-13484 or the next vulnerability affects your stack