Bug 2484710 (CVE-2026-14251)

Summary: CVE-2026-14251 gitops-operator: gitops-operator: Missing allowedNamespace check in ReconcilerHook for ClusterRole/Role cases enables potential privilege escalation and DoS
Product: [Other] Security Response Reporter: OSIDB Bzimport <bzimport>
Component: vulnerabilityAssignee: Product Security <prodsec-ir-bot>
Status: NEW --- QA Contact:
Severity: high Docs Contact:
Priority: high    
Version: unspecifiedCC: anjoseph, jprabhak, security-response-team, wtam
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: ---
Doc Text:
A flaw was found in the OpenShift GitOps operator. The ClusterRole reconciler does not validate resource ownership when reconciling ClusterRole objects. A namespace-scoped Argo CD instance can trigger deletion of a ClusterRole owned by a cluster-scoped Argo CD instance by crafting a name collision, resulting in a denial of service.
 Story Points: ---
Clone Of: Environment:
Last Closed: Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Deadline: 2026-07-06   

Description OSIDB Bzimport 2026-06-04 11:02:12 UTC 
The ReconcilerHook function in controllers/argocd/openshift/openshift.go does not call allowedNamespace() for the *rbacv1.ClusterRole and *rbacv1.Role type-switch cases. The primary escalation path appears mitigated by an outer gate in argocd-operator's reconcileClusterRole, but this mitigation is unverified for exhaustiveness and resides in a different upstream repository. A separate DoS vector exists via ClusterRole name collisions exploiting the gate's DELETE logic.