CVE-2024-13484 is a namespace isolation break in the openshift-gitops-operator-container where the openshift.io/cluster-monitoring label is applied broadly to namespaces with ArgoCD CR instances. This permits those namespaces to create PrometheusRules that are rolled out cluster-wide, potentially impacting the platform monitoring stack. Exploitation requires local administrative access, which restricts the vulnerability's exploitability. Red Hat has issued a security update in OpenShift GitOps version 1.16.2 to fix this issue. No effective mitigation other than applying the update is currently available according to Red Hat Product Security.

If exploited, this vulnerability allows a local attacker with admin privileges to create rogue PrometheusRules that propagate cluster-wide, potentially disrupting or manipulating the platform monitoring stack. This can lead to confidentiality, integrity, and availability impacts on monitoring data and operations. However, the requirement for local admin privileges limits the risk to trusted users with elevated access.

Red Hat has released an official security update in Red Hat OpenShift GitOps version 1.16.2 that fixes this vulnerability. Applying this update is the recommended remediation. No other mitigation meeting Red Hat's criteria for ease of use and applicability is currently available. Users should ensure all relevant errata are applied before updating. Since this is not a cloud service, remediation is the responsibility of the system administrator.