Cross-namespace privilege escalation in ArgoCD Image Updater (CVE-2026-6388)

A flaw in ArgoCD Image Updater (a component of Red Hat OpenShift GitOps) allows an attacker with permissions to create or modify ImageUpdater resources to bypass namespace boundaries in multi-tenant environments. By exploiting insufficient namespace validation, the attacker can trigger unauthorized image updates on applications managed by other tenants. This results in cross-namespace privilege escalation and impacts application integrity. Affected versions: - Red Hat OpenShift GitOps versions prior to v1.19.2 We recommend updating to: v1.19.2. CVSS 9.1 · our assessment: act_now Reference: https://access.redhat.com/security/cve/CVE-2026-6388 Details: https://vuln.today/cve/CVE-2026-6388