by Kastro
Paper/Archive/CVE-2026-6388

CVE-2026-6388

Red Hat Red Hat OpenShift GitOps — Argocd-image-updater: argocd image updater: cross-namespace privilege escalation via insufficient namespace validation

EPSS 0.4%CVSS 9.1
critical.is priorityof 100
33
CVSS 9.1 (CNA)9.1 / 10 × 3027.3Not in CISA KEV+300.0EPSS percentile 29.4.294 × 205.9No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

A flaw was found in ArgoCD Image Updater. This vulnerability allows an attacker, with permissions to create or modify an ImageUpdater resource in a multi-tenant environment, to bypass namespace boundaries. By exploiting insufficient validation, the attacker can trigger unauthorized image updates on applications managed by other tenants. This leads to cross-namespace privilege escalation, impacting application integrity through unauthorized application updates.

Affected

ProductAffectedFixed inSource
Red Hat OpenShift GitOpssee advisory–CNA
Red Hat OpenShift GitOpssee advisory–redhat-SADP

Scores by source

redhat (CNA)9.1CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:H/A:L
redhat-SADP (CNA)9.1CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:H/A:L
CISA ADPSSVCExploitation: none · Automatable: no · Technical impact: partial

References

refaccess.redhat.com/security/cve/CVE-2026-6388refbugzilla.redhat.com/show_bug.cgi?id=2458766refsecurity.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-6388.json