Red Hat OpenShift GitOps Operator Namespace Isolation Vulnerability

A vulnerability exists in the OpenShift GitOps operator container, where the label 'openshift.io/cluster-monitoring' is automatically applied to all namespaces with an ArgoCD custom resource instance. This label allows the creation of a potentially harmful PrometheusRule that impacts the entire platform monitoring stack, as the rule is distributed cluster-wide. This vulnerability breaks namespace isolation, enabling broader effects on the cluster.

Impact

Exploitation of this vulnerability can lead to a namespace isolation breach, allowing a user to affect the entire cluster from their namespace.

Remediation

Users can update to Red Hat OpenShift GitOps version 1.15.2 or 1.14.4, depending on their current version. Instructions for applying this update are available on the Red Hat Customer Portal.