8.2High
CVE-2024-13484Openshift-gitops-operator-container: namespace isolation break
Description
A flaw was found in openshift-gitops-operator-container. The openshift.io/cluster-monitoring label is applied to all namespaces that deploy an ArgoCD CR instance, allowing the namespace to create a rogue PrometheusRule. This issue can have adverse effects on the platform monitoring stack, as the rule is rolled out cluster-wide when the label is applied.
Weakness (CWE):
CWE-668
Data: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Published as the sources state it, in English.
Affected products and versions
| Vendor | Product | Versions | |
|---|---|---|---|
| openshift gitops | 1.14 | — | |
| openshift gitops | 1.15 | — | |
| openshift gitops | 1.16 | — | |
| Red Hat | Red Hat OpenShift GitOps 1.14 | all versions | |
| Red Hat | Red Hat OpenShift GitOps 1.15 | all versions | |
| Red Hat | Red Hat OpenShift GitOps 1.16 | all versions | |
| — | gitops-operator | < 1.13 |
References and patches
- RHSA-2025:7753 vendor-advisory
- RHSA-2025:8274 vendor-advisory
- RHSA-2025:9506 vendor-advisory
- https://access.redhat.com/security/cve/CVE-2024-13484 vdb-entry
- RHBZ#2269376 issue-tracking
- https://github.com/redhat-developer/gitops-operator/pull/853
- https://github.com/redhat-developer/gitops-operator/pull/867
- https://github.com/redhat-developer/gitops-operator/pull/868
- https://github.com/redhat-developer/gitops-operator/pull/869