Red Hat Openshift Gitops vulnerabilities

16 CVEs affecting Red Hat Openshift Gitops, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2026-14251, published 2026-07-15.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2024-1394, published 2024-03-21. High severity, CVSS 7.5. EPSS: 1.5% chance of exploitation in the next 30 days. A memory leak flaw was found in Golang in the RSA encrypting/decrypting code, which might lead to a resource exhaustion vulnerability using attacker-controlled inputs. The memory leak happens in…
CVE-2026-35469, published 2026-04-16. Medium severity, CVSS 6.5. EPSS: 0.8% chance of exploitation in the next 30 days. spdystream is a Go library for multiplexing streams over SPDY connections. In versions 0.5.0 and below, the SPDY/3 frame parser does not validate attacker-controlled counts and lengths before…
CVE-2023-6717, published 2024-04-25. Medium severity, CVSS 6.0. EPSS: 0.7% chance of exploitation in the next 30 days. A flaw was found in the SAML client registration in Keycloak that could allow an administrator to register malicious JavaScript URIs as Assertion Consumer Service POST Binding URLs (ACS), posing a…
CVE-2025-13888, published 2025-12-15. Critical severity, CVSS 9.1. EPSS: 0.7% chance of exploitation in the next 30 days. A flaw was found in OpenShift GitOps. Namespace admins can create ArgoCD Custom Resources (CRs) that trick the system into granting them elevated permissions in other namespaces, including privileged…
CVE-2024-12401, published 2024-12-12. Medium severity, CVSS 4.4. EPSS: 0.7% chance of exploitation in the next 30 days. A flaw was found in the cert-manager package. This flaw allows an attacker who can modify PEM data that the cert-manager reads, for example, in a Secret resource, to use large amounts of CPU in the…
CVE-2026-12143, published 2026-06-12. High severity, CVSS 7.5. EPSS: 0.7% chance of exploitation in the next 30 days. form-data is a library for creating readable multipart/form-data streams. In versions through 4.0.5, the `field` argument to `FormData#append` and the `filename` option are concatenated verbatim into…
CVE-2026-27145, published 2026-06-02. Medium severity, CVSS 6.5. EPSS: 0.6% chance of exploitation in the next 30 days. (*x509.Certificate).VerifyHostname previously called matchHostnames in a loop over all DNS Subject Alternative Name (SAN) entries. This caused strings.Split(host, ".") to execute repeatedly on the…
CVE-2025-69873, published 2026-02-11. Low severity, CVSS 2.9. EPSS: 0.5% chance of exploitation in the next 30 days. ajv (Another JSON Schema Validator) before 8.18.0 is vulnerable to Regular Expression Denial of Service (ReDoS) when the $data option is enabled. The pattern keyword accepts runtime data via JSON…
CVE-2025-8556, published 2025-08-06. Low severity, CVSS 3.7. EPSS: 0.5% chance of exploitation in the next 30 days. A flaw was found in CIRCL's implementation of the FourQ elliptic curve. This vulnerability allows an attacker to compromise session security via low-order point injection and incorrect point…
CVE-2026-15416, published 2026-07-14. High severity, CVSS 8.9. EPSS: 0.5% chance of exploitation in the next 30 days. A flaw was identified in Argo CD, the GitOps engine used by Red Hat OpenShift GitOps, that could allow an unauthenticated attacker with network access to the Argo CD repo-server to achieve remote…

Latest

CVE-2026-14251, published 2026-07-15. High severity, CVSS 7.7. EPSS: 0.4% chance of exploitation in the next 30 days. A flaw was found in the OpenShift GitOps operator. The ClusterRole reconciler does not validate resource ownership when reconciling ClusterRole objects. A namespace-scoped Argo CD instance can…
CVE-2026-43824, published 2026-05-02. High severity, CVSS 7.7. EPSS: 0.3% chance of exploitation in the next 30 days. In Argo CD 3.2.0 before 3.2.11 and 3.3.0 before 3.3.9, ServerSideDiff allows reading cleartext Kubernetes Secret data.
CVE-2026-6388, published 2026-04-15. Critical severity, CVSS 9.1. EPSS: 0.4% chance of exploitation in the next 30 days. A flaw was found in ArgoCD Image Updater. This vulnerability allows an attacker, with permissions to create or modify an ImageUpdater resource in a multi-tenant environment, to bypass namespace…
CVE-2025-11065, published 2026-01-26. Medium severity, CVSS 5.3. EPSS: 0.4% chance of exploitation in the next 30 days. A flaw was found in github.com/go-viper/mapstructure/v2, in the field processing component using mapstructure.WeakDecode. This vulnerability allows information disclosure through detailed error…
CVE-2026-0775, published 2026-01-23. High severity, CVSS 7.0. EPSS: 0.3% chance of exploitation in the next 30 days. npm cli Incorrect Permission Assignment Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of npm cli. An attacker…