CVE-2026-6388 Details

A vulnerability in ArgoCD Image Updater allows an attacker with permissions to create or modify ImageUpdater resources in a multi-tenant environment to bypass namespace boundaries. This exploitation of insufficient validation can trigger unauthorized image updates on applications managed by other tenants, leading to cross-namespace privilege escalation and compromising application integrity through unauthorized updates.

To address this vulnerability, ensure that AppProject resources enforce strict tenant isolation within Red Hat OpenShift GitOps environments. Additionally, restrict the permissions of the Argo CD Image Updater controller to designated namespaces only, and limit the ability to create or modify ImageUpdater resources to trusted administrators.