CVE-2026-14251

{
  "id": "CVE-2026-14251",
  "sourceIdentifier": "[email protected]",
  "published": "2026-07-15T08:16:22.383",
  "lastModified": "2026-10-24T22:10:00.210",
  "vulnStatus": "Deferred",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "A flaw was found in the OpenShift GitOps operator. The ClusterRole reconciler does not validate resource ownership when reconciling ClusterRole objects. A namespace-scoped Argo CD instance can trigger deletion of a ClusterRole owned by a cluster-scoped Argo CD instance by crafting a name collision, resulting in a denial of service."
    },
    {
      "lang": "es",
      "value": "Se encontró una vulnerabilidad en el operador OpenShift GitOps. El reconciliador de ClusterRole no valida la propiedad de los recursos al reconciliar objetos ClusterRole. Una instancia de Argo CD con ámbito de espacio de nombres puede desencadenar la eliminación de un ClusterRole propiedad de una instancia de Argo CD con ámbito de clúster al crear una colisión de nombres, lo que resulta en una denegación de servicio."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "Red Hat",
          "product": "Red Hat OpenShift GitOps",
          "defaultStatus": "affected",
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "packageName": "openshift-gitops-1/gitops-rhel8-operator",
          "cpes": [
            "cpe:/a:redhat:openshift_gitops:1"
          ]
        },
        {
          "vendor": "Red Hat",
          "product": "Red Hat OpenShift GitOps",
          "defaultStatus": "affected",
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "packageName": "openshift-gitops-1/gitops-rhel9-operator",
          "cpes": [
            "cpe:/a:redhat:openshift_gitops:1"
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "[email protected]",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H",
          "baseScore": 7.7,
          "baseSeverity": "HIGH",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "privilegesRequired": "LOW",
          "userInteraction": "NONE",
          "scope": "CHANGED",
          "confidentialityImpact": "NONE",
          "integrityImpact": "NONE",
          "availabilityImpact": "HIGH"
        },
        "exploitabilityScore": 3.1,
        "impactScore": 4.0
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2026-07-16T15:11:57.167463Z",
          "id": "CVE-2026-14251",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "[email protected]",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-862"
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://access.redhat.com/security/cve/CVE-2026-14251",
      "source": "[email protected]"
    },
    {
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2484710",
      "source": "[email protected]"
    }
  ]
}