The flaw lies in ArgoCD Image Updater, permitting an attacker who can create or edit an ImageUpdater resource in a multi‑tenant environment to bypass namespace boundaries due to insufficient validation. The attacker can trigger image updates on applications belonging to other tenants, escalating privileges across namespaces and compromising the integrity of those applications.

Red Hat OpenShift GitOps (v1 or unspecified) is the affected product, as identified by the Red Hat CPE entry cpe:/a:redhat:openshift_gitops:1.

The CVSS score of 9.1 indicates a high‑severity vulnerability. While the EPSS score is not available and the vulnerability is not listed in the KEV catalog, the lack of public exploits does not mitigate the risk. Attackers need only the ability to create or edit ImageUpdater resources, a privilege that can be granted to cluster‑admin or project‑admin roles. Once granted, the attacker can perform unrestricted image updates across namespaces, effectively achieving cross‑namespace privilege escalation. The attack vector is inferred to be privilege‑based, relying on misconfigured or overly permissive RBAC.