Red Hat OpenShift GitOps version 1.16 contains a namespace isolation break vulnerability (CVE-2024-13484) in the openshift-gitops-operator-container component. This vulnerability could allow improper namespace isolation, potentially impacting the security boundaries within the cluster. The Red Hat advisory RHSA-2025:9506 provides an update (v1.16.2) that addresses this issue along with several bug fixes. The update fixes the acceptance of regular expressions in sourceNamespaces, enforces Pod Security restricted policies for gitops-plugin Pods, and corrects missing ArgoCD commit IDs in the UI. The advisory does not provide a CVSS score but classifies the severity as moderate (medium). There are no known exploits in the wild, and the vendor recommends applying the update after ensuring all previous errata are applied.

The namespace isolation break vulnerability could allow a breach in the intended isolation between namespaces in OpenShift GitOps, potentially leading to unauthorized access or actions across namespaces. This could undermine the security model of the cluster by allowing components or users to interact with resources outside their authorized namespace boundaries. The bug fixes improve operator behavior and compliance with security policies but do not directly affect the severity of the vulnerability. No active exploitation has been reported.

A security update is available from Red Hat as part of OpenShift GitOps version 1.16.2. Users should apply this update following Red Hat's documented procedures and ensure all previously released errata are installed before updating. The vendor advisory RHSA-2025:9506 provides detailed instructions and references for applying the update. No additional mitigation steps are indicated beyond applying the official update.