CVE Feed

    Dashboard / CVE / CVE-2025-13888

    CVE-2025-13888

    A flaw was found in OpenShift GitOps. Namespace admins can create ArgoCD Custom Resources (CRs) that trick the system into granting them elevated permissions in other namespaces, including privileged namespaces. An authenticated attacker can then use these elevated permissions to create privileged workloads that run on master nodes, effectively giving them root access to the entire cluster.

    Published:Dec 15, 2025
    Last Modified:Apr 15, 2026
    EPS:Dec 15, 2025
    EPSS Score:0.00038
    CVSS Score:9.1

    Affected Products

    Vendor
    Redhat
    Product
    Openshift Gitops

    Exploits

    No exploit reference

    Common Weakness Enumeration

    CWE-266 Incorrect Privilege Assignment

    Common Attack Pattern Enumeration and Classification (CAPEC)

    No CAPEC recorded yet

    Related CVEs

    CVE-2026-14251 (CVSS 7.7) — A flaw was found in the OpenShift GitOps operator. The ClusterRole reconciler does not validate resource owner…
    CVE-2026-15416 (CVSS 8.9) — A flaw was identified in Argo CD, the GitOps engine used by Red Hat OpenShift GitOps, that could allow an unau…
    CVE-2026-42880 (CVSS 9.6) — Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. From versions 3.2.0 to before 3.2.11…
    CVE-2026-6388 (CVSS 9.1) — A flaw was found in ArgoCD Image Updater. This vulnerability allows an attacker, with permissions to create or…
    CVE-2025-55190 (CVSS 9.9) — Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. In versions 2.13.0 through 2.13.8, 2…
    CVE-2025-11065 (CVSS 5.3) — A flaw was found in github.com/go-viper/mapstructure/v2, in the field processing component using mapstructure.…
    CVE-2025-8556 (CVSS 3.7) — A flaw was found in CIRCL's implementation of the FourQ elliptic curve. This vulnerability allows an attacker …
    CVE-2025-47933 (CVSS 9) — Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. Prior to versions 2.13.8, 2.14.13, a…
    CVE-2024-57083 (CVSS 7.5) — A prototype pollution in the component Module.mergeObjects (redoc/bundles/redoc.lib.js:2) of redoc <= 2.2.0 al…
    CVE-2025-30204 (CVSS 7.5) — golang-jwt is a Go implementation of JSON Web Tokens. Starting in version 3.2.0 and prior to versions 5.2.2 an…

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High