Copyright © 2012 Red Hat, Inc. All rights reserved. Important 2026-07-06T00:00:00 gitops-operator: gitops-operator: Missing allowedNamespace check in ReconcilerHook for ClusterRole/Role cases enables potential privilege escalation and DoS 7.7 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H CWE-862

A flaw was found in the OpenShift GitOps operator. The ClusterRole reconciler does not validate resource ownership when reconciling ClusterRole objects. A namespace-scoped Argo CD instance can trigger deletion of a ClusterRole owned by a cluster-scoped Argo CD instance by crafting a name collision, resulting in a denial of service.

A flaw was found in the OpenShift GitOps operator. The ClusterRole reconciler does not validate resource ownership when reconciling ClusterRole objects. A namespace-scoped Argo CD instance can trigger deletion of a ClusterRole owned by a cluster-scoped Argo CD instance by crafting a name collision, resulting in a denial of service.

Red Hat would like to thank Nebojša Jaćović for reporting this issue. Red Hat OpenShift GitOps Affected openshift-gitops-1/gitops-rhel8-operator Red Hat OpenShift GitOps Affected openshift-gitops-1/gitops-rhel9-operator https://www.cve.org/CVERecord?id=CVE-2026-14251 https://nvd.nist.gov/vuln/detail/CVE-2026-14251