CVE-2026-14251 | A flaw was found in the OpenShift GitOps operator. The Clust… | CVSS 7.7 HIGH

Description

A flaw was found in the OpenShift GitOps operator. The ClusterRole reconciler does not validate resource ownership when reconciling ClusterRole objects. A namespace-scoped Argo CD instance can trigger deletion of a ClusterRole owned by a cluster-scoped Argo CD instance by crafting a name collision, resulting in a denial of service.

Metadata

CVE ID: CVE-2026-14251
State: PUBLISHED
Assigner: redhat
Reserved: 2026-06-30 14:20 UTC
Published: 2026-07-15 07:01 UTC
Last updated: 2026-07-15 07:01 UTC
Primary CWE: CWE-862
Missing Authorization
Vendor / Product: Red Hat / Red Hat OpenShift GitOps
Sources: cve.org · NVD

Severity & Metrics

7.7 HIGH CVSS 3.1

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H

Affected products (2)

Vendor	Product	Platform	Versions
Red Hat	Red Hat OpenShift GitOps	—	—
Red Hat	Red Hat OpenShift GitOps	—	—

Weakness (CWE)

CWE	Source	Description
CWE-862	cna	Missing Authorization

CVSS scores (1)

Score	Severity	Version	Source	Vector
7.7	HIGH	3.1	cna	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H

References (2)