What is the CVSS score of CVE-2026-14251?

CVE-2026-14251 has a CVSS 3.1 base score of 7.7 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H. EPSS exploitation probability: 0.2%.

Which versions of OpenShift GitOps are affected by CVE-2026-14251?

Red Hat OpenShift GitOps deployments are vulnerable to a cross-tenant privilege escalation (CVE-2026-14251, CVSS 7.7) that allows low-privileged tenants to disrupt cluster-wide GitOps operations.

How to fix or mitigate CVE-2026-14251?

Within 24 hours, identify all OpenShift GitOps deployments in your environment and assess whether multi-tenant isolation is active. Within 7 days, implement restrictive RBAC policies to limit ClusterRole modifications to cluster-admin only, enable audit logging for all ClusterRole changes, and where feasible, restrict namespace-scoped GitOps instances from accessing cluster-scoped resources. Within 30 days, monitor Red Hat security advisories for an available patch and establish an upgrade timeline; maintain compensating controls until patched.

OpenShift GitOps CVE-2026-14251

EUVD-2026-44596 HIGH

Missing Authorization (CWE-862)

2026-07-15 redhat

GHSA-g9w9-rqjq-9rf5

Authentication Bypass Denial Of Service Red Hat Red Hat Openshift Gitops Red Hat

7.7

CVSS 3.1 · Vendor: redhat

Severity by source

Vendor (redhat) PRIMARY

7.7 HIGH

AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H

vuln.today AI

7.7 HIGH

Authorized tenant controlling a namespace-scoped instance (PR:L) acts over the API (AV:N/AC:L) to delete another instance's ClusterRole (S:C), causing availability-only impact (A:H, C/I:N).

3.1 AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:H

Red Hat

7.7 HIGH

qualitative

Primary rating from Vendor (redhat).

CVSS VectorVendor: redhat

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 15, 2026 - 08:01 vuln.today

CVE Published

Jul 15, 2026 - 07:01 cve.org

HIGH 7.7

DescriptionCVE.org

A flaw was found in the OpenShift GitOps operator. The ClusterRole reconciler does not validate resource ownership when reconciling ClusterRole objects. A namespace-scoped Argo CD instance can trigger deletion of a ClusterRole owned by a cluster-scoped Argo CD instance by crafting a name collision, resulting in a denial of service.

AnalysisAI

Denial of service in Red Hat OpenShift GitOps (Argo CD operator) lets a tenant who controls a namespace-scoped Argo CD instance delete a ClusterRole belonging to a cluster-scoped Argo CD instance by crafting a name collision. Because the ClusterRole reconciler skips ownership validation (CWE-862), a low-privileged tenant can disrupt a higher-privileged, cluster-wide GitOps instance across the trust boundary. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the cross-tenant scope change makes it a meaningful multi-tenancy integrity concern.

Technical ContextAI

The affected component is the OpenShift GitOps operator, Red Hat's supported packaging of Argo CD for OpenShift/Kubernetes continuous delivery. Argo CD can be deployed either cluster-scoped (managing resources across the whole cluster, typically with powerful ClusterRoles) or namespace-scoped (managing only a delegated tenant namespace). The operator's ClusterRole reconciler is responsible for creating and pruning the RBAC ClusterRole objects that back these instances. The root cause is CWE-862 (Missing Authorization / missing resource-ownership validation): when reconciling ClusterRole objects, the controller matches by name without verifying which Argo CD instance actually owns the object. Because ClusterRoles are cluster-scoped Kubernetes objects sharing a single global namespace, a namespace-scoped instance can be made to reconcile a name that collides with a cluster-scoped instance's ClusterRole, and the reconciler deletes it.

RemediationAI

No vendor-released patch version is identified in the available data - the references point only to the Red Hat CVE page (https://access.redhat.com/security/cve/CVE-2026-14251) and Bugzilla 2484710 (https://bugzilla.redhat.com/show_bug.cgi?id=2484710), which should be monitored for the fixed operator version and applied via the OpenShift OperatorHub/OLM channel as soon as it ships. As a compensating control until a patch is available, avoid running cluster-scoped and untrusted namespace-scoped Argo CD instances on the same cluster; restrict who can create or manage namespace-scoped Argo CD instances (limit ArgoCD custom-resource creation via RBAC) so that only trusted operators can trigger ClusterRole reconciliation, accepting the trade-off of reduced tenant self-service. Additionally, enforce naming conventions/admission policies (e.g., an OPA/Gatekeeper or Kyverno policy) that prevent tenant instances from producing ClusterRole names that collide with cluster-scoped instances, and monitor for unexpected ClusterRole deletions in audit logs so a DoS can be detected and the ClusterRole quickly recreated.