Technical impact
The OpenShift GitOps operator’s ClusterRole reconciler fails to enforce namespace scoping when reconciling ClusterRole objects, creating a missing authorization check (CWE‑862). A user who can control a namespace‑scoped Argo CD instance can craft a name collision with a cluster‑scoped ClusterRole, causing the reconciler to delete that role. Removal of a ClusterRole can interrupt all actions that depend on it, effectively denying service. The impact therefore spans service interruption within the cluster.
Affected Systems
Red Hat OpenShift GitOps deployments are affected. All releases that include the default reconciler logic are vulnerable; specific version ranges are not enumerated in the advisory.
Risk and Exploitability
The CVSS score of 7.7 classifies the issue as high severity. The EPSS score is below 1 %, indicating a very low probability of exploitation, and the vulnerability is not listed in CISA’s KEV catalog, suggesting a moderate overall risk. The likely attack vector involves an attacker controlling a namespace‑scoped Argo CD instance with the ability to create objects that collide with existing cluster‑scoped ClusterRoles; after the collision is established, the reconciler deletes the role without needing elevated privileges. This inference is drawn from the description which states that a namespace‑scoped instance can trigger deletion of a ClusterRole owned by a cluster‑scoped instance through a name collision.
