CVE-2026-15416

Name of the Vulnerable Software and Affected Versions OpenShift Data Foundation 4 odf-multicluster-rhel9-operator (affected versions not specified) OpenShift GitOps argocd-image-updater-rhel8 (affected versions not specified) OpenShift GitOps argocd-rhel8 (affected versions not specified) OpenShift GitOps gitops-operator-bundle (affected versions not specified) OpenShift GitOps gitops-rhel8 (affected versions not specified) OpenShift GitOps gitops-rhel8-operator (affected versions not specified)

Description A flaw in the Argo CD repo-server, used by Red Hat OpenShift GitOps, allows an unauthenticated attacker with network access to the internal gRPC endpoint to achieve remote code execution. If the attacker can also access the Redis cache, they may manipulate cached data to deploy malicious Kubernetes resources to managed clusters, which could lead to a complete cluster compromise.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability. Lock down the repo-server and Redis services using NetworkPolicies to ensure they are not exposed externally or to untrusted pods.