CVE-2026-14251

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-14251", "assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749", "state": "PUBLISHED", "assignerShortName": "redhat", "dateReserved": "2026-06-30T14:20:10.616Z", "datePublished": "2026-07-15T07:01:00.229Z", "dateUpdated": "2026-07-16T15:12:26.794Z"}, "containers": {"cna": {"title": "Gitops-operator: gitops-operator: missing allowednamespace check in reconcilerhook for clusterrole/role cases enables potential privilege escalation and dos", "metrics": [{"other": {"content": {"value": "Important", "namespace": "https://access.redhat.com/security/updates/classification/"}, "type": "Red Hat severity rating"}}, {"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.7, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H", "version": "3.1"}, "format": "CVSS"}], "descriptions": [{"lang": "en", "value": "A flaw was found in the OpenShift GitOps operator. The ClusterRole reconciler does not validate resource ownership when reconciling ClusterRole objects. A namespace-scoped Argo CD instance can trigger deletion of a ClusterRole owned by a cluster-scoped Argo CD instance by crafting a name collision, resulting in a denial of service."}], "affected": [{"vendor": "Red Hat", "product": "Red Hat OpenShift GitOps", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "packageName": "openshift-gitops-1/gitops-rhel8-operator", "defaultStatus": "affected", "cpes": ["cpe:/a:redhat:openshift_gitops:1"]}, {"vendor": "Red Hat", "product": "Red Hat OpenShift GitOps", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "packageName": "openshift-gitops-1/gitops-rhel9-operator", "defaultStatus": "affected", "cpes": ["cpe:/a:redhat:openshift_gitops:1"]}], "references": [{"url": "https://access.redhat.com/security/cve/CVE-2026-14251", "tags": ["vdb-entry", "x_refsource_REDHAT"]}, {"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2484710", "name": "RHBZ#2484710", "tags": ["issue-tracking", "x_refsource_REDHAT"]}], "datePublic": "2026-07-06T00:00:00.000Z", "problemTypes": [{"descriptions": [{"cweId": "CWE-862", "description": "Missing Authorization", "lang": "en", "type": "CWE"}]}], "x_redhatCweChain": "CWE-862: Missing Authorization", "timeline": [{"lang": "en", "time": "2026-05-14T00:00:00.000Z", "value": "Reported to Red Hat."}, {"lang": "en", "time": "2026-07-06T00:00:00.000Z", "value": "Made public."}], "credits": [{"lang": "en", "value": "Red Hat would like to thank Neboj\u0161a Ja\u0107ovi\u0107 for reporting this issue."}], "providerMetadata": {"orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749", "shortName": "redhat", "dateUpdated": "2026-07-15T07:01:00.229Z"}, "x_generator": {"engine": "cvelib 1.8.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-07-16T15:11:57.167463Z", "id": "CVE-2026-14251", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-07-16T15:12:26.794Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-14251", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-07-16T15:11:57.167463Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-07-16T15:12:17.212Z"}}], "cna": {"title": "Gitops-operator: gitops-operator: missing allowednamespace check in reconcilerhook for clusterrole/role cases enables potential privilege escalation and dos", "credits": [{"lang": "en", "value": "Red Hat would like to thank Neboj\u0161a Ja\u0107ovi\u0107 for reporting this issue."}], "metrics": [{"other": {"type": "Red Hat severity rating", "content": {"value": "Important", "namespace": "https://access.redhat.com/security/updates/classification/"}}}, {"format": "CVSS", "cvssV3_1": {"scope": "CHANGED", "version": "3.1", "baseScore": 7.7, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "NONE"}}], "affected": [{"cpes": ["cpe:/a:redhat:openshift_gitops:1"], "vendor": "Red Hat", "product": "Red Hat OpenShift GitOps", "packageName": "openshift-gitops-1/gitops-rhel8-operator", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:openshift_gitops:1"], "vendor": "Red Hat", "product": "Red Hat OpenShift GitOps", "packageName": "openshift-gitops-1/gitops-rhel9-operator", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected"}], "timeline": [{"lang": "en", "time": "2026-05-14T00:00:00.000Z", "value": "Reported to Red Hat."}, {"lang": "en", "time": "2026-07-06T00:00:00.000Z", "value": "Made public."}], "datePublic": "2026-07-06T00:00:00.000Z", "references": [{"url": "https://access.redhat.com/security/cve/CVE-2026-14251", "tags": ["vdb-entry", "x_refsource_REDHAT"]}, {"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2484710", "name": "RHBZ#2484710", "tags": ["issue-tracking", "x_refsource_REDHAT"]}], "x_generator": {"engine": "cvelib 1.8.0"}, "descriptions": [{"lang": "en", "value": "A flaw was found in the OpenShift GitOps operator. The ClusterRole reconciler does not validate resource ownership when reconciling ClusterRole objects. A namespace-scoped Argo CD instance can trigger deletion of a ClusterRole owned by a cluster-scoped Argo CD instance by crafting a name collision, resulting in a denial of service."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-862", "description": "Missing Authorization"}]}], "providerMetadata": {"orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749", "shortName": "redhat", "dateUpdated": "2026-07-15T07:01:00.229Z"}, "x_redhatCweChain": "CWE-862: Missing Authorization"}}, "cveMetadata": {"cveId": "CVE-2026-14251", "state": "PUBLISHED", "dateUpdated": "2026-07-16T15:12:26.794Z", "dateReserved": "2026-06-30T14:20:10.616Z", "assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749", "datePublished": "2026-07-15T07:01:00.229Z", "assignerShortName": "redhat"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:openshift_gitops:1"], "defaultStatus": "affected", "packageName": "openshift-gitops-1/gitops-rhel8-operator", "product": "Red Hat OpenShift GitOps", "vendor": "Red Hat"}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:openshift_gitops:1"], "defaultStatus": "affected", "packageName": "openshift-gitops-1/gitops-rhel9-operator", "product": "Red Hat OpenShift GitOps", "vendor": "Red Hat"}], "source": "secalert@redhat.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "A flaw was found in the OpenShift GitOps operator. The ClusterRole reconciler does not validate resource ownership when reconciling ClusterRole objects. A namespace-scoped Argo CD instance can trigger deletion of a ClusterRole owned by a cluster-scoped Argo CD instance by crafting a name collision, resulting in a denial of service."}, {"lang": "es", "value": "Se encontr\u00f3 una vulnerabilidad en el operador OpenShift GitOps. El reconciliador de ClusterRole no valida la propiedad de los recursos al reconciliar objetos ClusterRole. Una instancia de Argo CD con \u00e1mbito de espacio de nombres puede desencadenar la eliminaci\u00f3n de un ClusterRole propiedad de una instancia de Argo CD con \u00e1mbito de cl\u00faster al crear una colisi\u00f3n de nombres, lo que resulta en una denegaci\u00f3n de servicio."}], "id": "CVE-2026-14251", "lastModified": "2026-10-24T22:10:00.210", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.7, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 3.1, "impactScore": 4.0, "source": "secalert@redhat.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-14251", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-07-16T15:11:57.167463Z", "version": "2.0.3"}}]}, "published": "2026-07-15T08:16:22.383", "references": [{"source": "secalert@redhat.com", "url": "https://access.redhat.com/security/cve/CVE-2026-14251"}, {"source": "secalert@redhat.com", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2484710"}], "sourceIdentifier": "secalert@redhat.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-862"}], "source": "secalert@redhat.com", "type": "Secondary"}]}

{"acknowledgement": "Red Hat would like to thank Neboj\u0161a Ja\u0107ovi\u0107 for reporting this issue.", "bugzilla": {"description": "gitops-operator: gitops-operator: Missing allowedNamespace check in ReconcilerHook for ClusterRole/Role cases enables potential privilege escalation and DoS", "id": "2484710", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2484710"}, "csaw": false, "cvss3": {"cvss3_base_score": "7.7", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H", "status": "draft"}, "cwe": "CWE-862", "details": ["A flaw was found in the OpenShift GitOps operator. The ClusterRole reconciler does not validate resource ownership when reconciling ClusterRole objects. A namespace-scoped Argo CD instance can trigger deletion of a ClusterRole owned by a cluster-scoped Argo CD instance by crafting a name collision, resulting in a denial of service."], "name": "CVE-2026-14251", "package_state": [{"cpe": "cpe:/a:redhat:openshift_gitops:1", "fix_state": "Affected", "package_name": "openshift-gitops-1/gitops-rhel8-operator", "product_name": "Red Hat OpenShift GitOps"}, {"cpe": "cpe:/a:redhat:openshift_gitops:1", "fix_state": "Affected", "package_name": "openshift-gitops-1/gitops-rhel9-operator", "product_name": "Red Hat OpenShift GitOps"}], "public_date": "2026-07-06T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-14251\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-14251"], "threat_severity": "Important"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": null}], "enrichment": {"confidence": 84.0, "confidence_source": "matching", "scores": [{"score": 84.0, "source": "matching"}]}, "original": {"product": "Red Hat OpenShift GitOps", "source": "cna", "vendor": "Red Hat"}, "product": "openshift_gitops", "vendor": "redhat"}], "created": "2026-07-17T06:00:04.664440+00:00", "updated": "2026-08-01T09:15:03.315834+00:00", "vendors": ["redhat", "redhat$PRODUCT$openshift_gitops"], "weaknesses": ["CWE-862"]}