Vulnerability · Published Apr 15, 2026 · Assigned by redhat

CVE-2026-6388Argocd-image-updater: argocd image updater: cross-namespace privilege escalation via insufficient namespace validation

Critical 9.1

In plain English

A critical-severity security flaw in Red Hat OpenShift GitOps from Red Hat. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 30% of all known vulnerabilities).

Severity (CVSS 3.1)9.1Critical

Exploit odds (30 days)0.4%top 70.5% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

A flaw was found in ArgoCD Image Updater. This vulnerability allows an attacker, with permissions to create or modify an ImageUpdater resource in a multi-tenant environment, to bypass namespace boundaries. By exploiting insufficient validation, the attacker can trigger unauthorized image updates on applications managed by other tenants. This leads to cross-namespace privilege escalation, impacting application integrity through unauthorized application updates.

Affected products (as reported)

Vendor	Product	Versions
Red Hat	Red Hat OpenShift GitOps	see references

Weakness: CWE-1220 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:H/A:L

References

https://access.redhat.com/security/cve/CVE-2026-6388 vdb-entry, x_refsource_REDHAT
RHBZ#2458766 issue-tracking, x_refsource_REDHAT
https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-6388.json x_sadp-csaf-vex