Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
8.2

OpenShift GitOps Operator lets any namespace alter cluster monitoring

CVE-2024-13484 · published 1 year ago
Summary

The OpenShift GitOps Operator automatically adds a special label to every namespace that runs an ArgoCD instance. This label lets those namespaces create monitoring rules that affect the whole cluster, potentially disrupting the platform's monitoring data. Remove the label from unnecessary namespaces or limit its use until the issue is fixed.

What to do
  • Update github.com redhat-developer to version 1.16.2.
Affected software
Ecosystem VendorProductAffected versions
go github.com redhat-developer < 1.16.2
Fix: upgrade to 1.16.2
Original advisory text
Openshift-gitops-operator-container: namespace isolation break
A flaw was found in openshift-gitops-operator-container. The openshift.io/cluster-monitoring label is applied to all namespaces that deploy an ArgoCD CR instance, allowing the namespace to create a rogue PrometheusRule. This issue can have adverse effects on the platform monitoring stack, as the rule is rolled out cluster-wide when the label is applied.
References
Fix within
Internet-facing 14 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit
  • Gives an attacker full control
Severity
8.2 High
Exploitation
<1% chance of attack within 30 days
Type
CWE-668Exposure of Resource to Wrong Sphere
Timeline
Published28 Jan 2025
Updated4 Nov 2026
First seen6 Mar 2026
Sources
GHSA-58fx-7v9q-3g56 · GHSA
CVE-2024-13484 · NVD
CVE-2024-13484 · OSV
Track software like this
Free during beta