EUVD-2026-44596
GHSA-g9w9-rqjq-9rf5
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessControl a namespace-scoped Argo CD instance
-
DeliveryCraft colliding ClusterRole name
-
ExploitOperator reconciler skips ownership check
-
ExecutionCluster-scoped instance's ClusterRole deleted
-
ImpactCross-tenant GitOps denial of service
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Authorization checks on every request
MITRE ATT&CK
1 technique across 1 tactic: Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires the attacker to already control a namespace-scoped Argo CD instance within an OpenShift GitOps deployment that ALSO runs a cluster-scoped Argo CD instance, and the attacker must craft a ClusterRole name collision so the operator's reconciler prunes the cluster-scoped instance's ClusterRole. The CVSS PR:L confirms authenticated/authorized tenant access is needed - this is not remote-unauthenticated. Limiting factors that reduce real-world exposure: the environment must be genuinely multi-tenant with mixed cluster-scoped and namespace-scoped instances at differing trust levels; single-instance or single-tenant clusters are not exploitable, and the attacker must have rights to create/configure a namespace-scoped Argo CD instance. Impact is availability/DoS only, with no confidentiality or integrity compromise. |
| Impact | The provided CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H, base 7.7) reflects a network-reachable, low-complexity action requiring only the low privileges of a tenant who already operates a namespace-scoped Argo CD instance, with a scope change (S:C) because the impact crosses from the attacker's tenant into the cluster-scoped instance's RBAC. Impact is availability-only (A:H); there is no direct confidentiality or integrity loss to data (C:N/I:N), consistent with a denial-of-service outcome. No EPSS score, SSVC decision, POC, or KEV entry was provided, so exploitation probability cannot be quantified from the input - the absence of a KEV listing and public exploit suggests this is not currently subject to opportunistic mass exploitation. This is a genuine multi-tenancy/RBAC boundary flaw rather than an inflated high-CVSS issue, but realistic risk is gated on the environment actually running mixed cluster-scoped and namespace-scoped Argo CD instances under distinct trust levels; single-tenant or fully-trusted deployments face little practical exposure. |
| Exploit ScenarioDerived | A malicious or compromised tenant who is permitted to run a namespace-scoped Argo CD instance configures it so its ClusterRole reconciler targets a name that collides with a ClusterRole owned by the platform team's cluster-scoped Argo CD instance. Because ownership is not validated, the operator prunes that ClusterRole, stripping the cluster-scoped instance of the RBAC it needs and denying service to all applications it manages. No public exploit code is identified at time of analysis, but the low complexity (AC:L) and low privilege bar (PR:L) make it straightforward for an authorized tenant. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jul 15, 2026
Denial of service in Red Hat OpenShift GitOps (Argo CD operator) lets a tenant who controls a namespace-scoped Argo CD instance delete a ClusterRole belonging to a cluster-scoped Argo CD instance by crafting a name collision. Because the ClusterRole reconciler skips ownership validation (CWE-862), a low-privileged tenant can disrupt a higher-privileged, cluster-wide GitOps instance across the trust boundary. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the cross-tenant scope change makes it a meaningful multi-tenancy integrity concern.
RemediationAI
No vendor-released patch version is identified in the available data - the references point only to the Red Hat CVE page (https://access.redhat.com/security/cve/CVE-2026-14251) and Bugzilla 2484710 (https://bugzilla.redhat.com/show_bug.cgi?id=2484710), which should be monitored for the fixed operator version and applied via the OpenShift OperatorHub/OLM channel as soon as it ships. As a compensating control until a patch is available, avoid running cluster-scoped and untrusted namespace-scoped Argo CD instances on the same cluster; restrict who can create or manage namespace-scoped Argo CD instances (limit ArgoCD custom-resource creation via RBAC) so that only trusted operators can trigger ClusterRole reconciliation, accepting the trade-off of reduced tenant self-service. Additionally, enforce naming conventions/admission policies (e.g., an OPA/Gatekeeper or Kyverno policy) that prevent tenant instances from producing ClusterRole names that collide with cluster-scoped instances, and monitor for unexpected ClusterRole deletions in audit logs so a DoS can be detected and the ClusterRole quickly recreated.
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The affected component is the OpenShift GitOps operator, Red Hat's supported packaging of Argo CD for OpenShift/Kubernetes continuous delivery. Argo CD can be deployed either cluster-scoped (managing resources across the whole cluster, typically with powerful ClusterRoles) or namespace-scoped (managing only a delegated tenant namespace). The operator's ClusterRole reconciler is responsible for creating and pruning the RBAC ClusterRole objects that back these instances. The root cause is CWE-862 (Missing Authorization / missing resource-ownership validation): when reconciling ClusterRole objects, the controller matches by name without verifying which Argo CD instance actually owns the object. Because ClusterRoles are cluster-scoped Kubernetes objects sharing a single global namespace, a namespace-scoped instance can be made to reconcile a name that collides with a cluster-scoped instance's ClusterRole, and the reconciler deletes it.
Know when Red Hat Openshift Gitops gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H
Authorized tenant controlling a namespace-scoped instance (PR:L) acts over the API (AV:N/AC:L) to delete another instance's ClusterRole (S:C), causing availability-only impact (A:H, C/I:N).
Primary rating from Vendor (redhat).
CVSS VectorVendor: redhat
DescriptionCVE.org
A flaw was found in the OpenShift GitOps operator. The ClusterRole reconciler does not validate resource ownership when reconciling ClusterRole objects. A namespace-scoped Argo CD instance can trigger deletion of a ClusterRole owned by a cluster-scoped Argo CD instance by crafting a name collision, resulting in a denial of service.
Executive ViewAI
Red Hat OpenShift GitOps deployments are vulnerable to a cross-tenant privilege escalation (CVE-2026-14251, CVSS 7.7) that allows low-privileged tenants to disrupt cluster-wide GitOps operations. Organizations running multi-tenant OpenShift environments face potential service outages and operational isolation breaches if tenants can manipulate cluster-level resources.
No vendor-released patch identified at time of analysis. Until patched, implement: strict RBAC policies limiting ClusterRole modifications to cluster-admin only; comprehensive audit logging for ClusterRole deletions; operational isolation between namespace-scoped and cluster-scoped Argo CD instances where feasible; and regular monitoring of cluster-scoped GitOps instances for unexpected ClusterRole changes.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
Affected Products (CPE)CVE.org
More in Red Hat Openshift Gitops
View allPrivilege escalation in ArgoCD Image Updater allows authenticated low-privileged users in a multi-tenant Red Hat OpenShi
Remote code execution in the Argo CD repo-server component (as shipped in Red Hat OpenShift GitOps and the argoproj argo
Exploit-DB