Argo CD Image Updater: ImageUpdater resource crosses namespaces to update other tenants' apps

Impact

Insufficient validation of ImageUpdater resources lets a tenant who can create or edit one in their own namespace trigger image updates on Applications owned by other tenants. In a shared GPU cluster that means changing which container image another team's training or inference workload runs - the attacker chooses the image, the platform deploys it on their behalf onto nodes they were never granted. The practical effect is integrity loss across the namespace boundary GitOps multi-tenancy depends on, and an unexpected rollout on nodes the victim team cannot easily drain. Red Hat scores it with low confidentiality and availability impact and high integrity impact; the record describes unauthorized updates, not a direct container escape.

Who can reach it

An authenticated cluster user with RBAC to create or modify an ImageUpdater resource in any namespace of a multi-tenant cluster running Argo CD Image Updater. No cluster-admin needed.

What to do

Apply the Red Hat OpenShift GitOps update for CVE-2026-6388 (see the Red Hat CVE page and the CSAF VEX for the fixed component versions in your channel) and restart the Image Updater controller - a control-plane deployment restart, no node maintenance. Until it is available, restrict who may create ImageUpdater resources and audit recent image changes on Applications for updates nobody on the owning team requested.

References

Related entries

• Argo CD: Stored XSS via a `javascript:` link executes in an admin's browserCVE-2022-31035 · Argo CDCritical
• Argo CD: Improper authorization causes the API to accept tokens it should rejectCVE-2023-22482 · Argo CDCritical
• AKS Confidential Containers: elevation of privilege across the confidential container boundaryCVE-2024-21400 · Azure Kubernetes Service Confidential Containers (az confcom tooling)Critical
• Argo CD: Improper URL protocol filtering in link annotations enables client-side attacks against adminsCVE-2024-28175 · Argo CDCritical
• Argo CD: An unprivileged pod in any namespace can reach the unauthenticated Argo CD Redis on 6379 and poisonCVE-2024-31989 · Argo CDCritical
• RHACM app-subscription: namespace edit rights escalate to cluster-admin via attacker-hosted Helm chartCVE-2026-10090 · Red Hat Advanced Cluster Management - multicluster-operators-subscription (app-subscription controller)Critical