Critical OpenShift GitOps Flaw Risks Cluster Takeover (CVE-2025-13888) via Privilege Escalation to Root

A critical vulnerability in Red Hat OpenShift GitOps, tracked as CVE-2025-13888 with a severity of 9.1 (Critical), can allow a namespace administrator to escalate to root on the entire cluster. The flaw stems from how the GitOps operator handles ArgoCD Custom Resources, effectively turning a standard administrative feature into a privilege escalation weapon.

By manipulating the sourceNamespaces field within an ArgoCD CR, a namespace admin can specify a target namespace—potentially a privileged one such as default—and encourage the operator to annotate it and create a RoleBinding and a Role in that namespace. Once the malicious CR is processed, the attacker’s service accounts gain access to the target namespace, enabling privileged workloads and potentially running privileged Jobs.

The report warns that the job could even execute on master nodes, giving the attacker root access to the master nodes and the ability to overtake the cluster, undermining Kubernetes multi-tenancy isolation. Administrators are advised to audit OpenShift GitOps operator versions and apply the latest security patches, and to restrict ArgoCD CR creation to trusted cluster administrators as a temporary mitigation.