Red Hat OpenShift GitOps versions from 1.18.0 up to but not including 1.18.3 are affected by multiple security vulnerabilities. The most significant is CVE-2025-13888, where namespace administrators can create ArgoCD Custom Resources that grant them elevated permissions in other namespaces, including privileged ones. This can be exploited to create privileged workloads running on master nodes, effectively granting root access to the entire cluster. Additional vulnerabilities addressed include denial of service via uncontrolled recursion in expression evaluation (CVE-2025-68156), unbounded memory allocation when parsing GNU sparse maps (CVE-2025-58183), and SSH client panic due to unexpected SSH_AGENT_SUCCESS (CVE-2025-47913). Red Hat has released OpenShift GitOps v1.18.3 containing fixes for these issues. The vulnerability requires authenticated namespace admin privileges, reducing exposure to internal threat actors. The advisory includes multiple CVEs and bug fixes related to privilege escalation, denial of service, and memory allocation errors.

An authenticated namespace administrator can exploit CVE-2025-13888 to escalate privileges across namespaces, including privileged namespaces, enabling creation of privileged workloads on master nodes and effectively gaining root access to the entire cluster. This represents a significant risk of full cluster compromise. Other vulnerabilities may lead to denial of service or unexpected client crashes, impacting availability and stability of the GitOps service. The attack surface is limited to authorized internal users with namespace admin rights, not external unauthenticated attackers.

Red Hat has released OpenShift GitOps version 1.18.3 which includes fixes for CVE-2025-13888 and other related vulnerabilities. Users should apply this update promptly after ensuring all prior relevant errata are applied. The vendor advisory confirms the availability of an official fix. No additional mitigations are specified beyond applying the update. Since the vulnerability requires authenticated namespace admin privileges, restricting such privileges to trusted users also reduces risk.