CVE-2025-55190 is an information leak vulnerability in Red Hat OpenShift GitOps (Argo CD component) where the project details API endpoint may unintentionally expose sensitive repository credentials. An attacker must have privileges to create or have stolen an API token to exploit this vulnerability. The impact is limited to tampering with projects associated with the compromised API token and does not grant full system control. Red Hat has issued a security update in OpenShift GitOps v1.19.1 to fix this issue. Additional fixes for related issues and enhancements are included in this update. The vulnerability is tracked under CWE-522 (Insufficiently Protected Credentials) and CWE-770 (Allocation of Resources Without Limits or Throttling).

The vulnerability allows an attacker with valid login credentials or a stolen API token to access sensitive repository credentials via the project details API endpoint. This can lead to unauthorized tampering with projects linked to the API token. However, it does not provide full system control or broader administrative privileges. The severity is rated as high due to the confidentiality, integrity, and availability impacts on the affected projects.

A security update is available in Red Hat OpenShift GitOps version 1.19.1 that addresses this vulnerability. Users should apply this update to remediate the issue. Currently, no effective mitigations meeting Red Hat's criteria for ease of use and applicability are available. Prior to updating, ensure all previously released errata relevant to your system have been applied. Refer to Red Hat's official advisory for detailed update instructions.