{"action":"Upgrade github.com/redhat-developer/gitops-operator to 1.16.2 or later.","affected":[{"fixed":"1.16.2","introduced":"0"}],"component":"github.com/redhat-developer/gitops-operator","cve_ids":["CVE-2025-13888"],"ecosystem":"Go","epss":0.00691,"exploited":false,"fixed_versions":["1.16.2"],"ghsa_id":"GHSA-pcqx-8qww-7f4v","id":"tcs_01M5KFH8VX78AFYHVP4E5ZPCHX","modified_at":"2026-02-03T03:10:03.339694Z","published_at":"2025-12-15T18:30:39Z","references":["https://osv.dev/vulnerability/GHSA-pcqx-8qww-7f4v","https://nvd.nist.gov/vuln/detail/CVE-2025-13888","https://github.com/redhat-developer/gitops-operator/pull/897","https://github.com/redhat-developer/gitops-operator/commit/bc6ac3e03d7c8b3db5d8f1770c868396a4c2dcef","https://access.redhat.com/errata/RHSA-2025:23203","https://access.redhat.com/errata/RHSA-2025:23206","https://access.redhat.com/errata/RHSA-2025:23207","https://access.redhat.com/errata/RHSA-2026:1017","https://access.redhat.com/security/cve/CVE-2025-13888","https://bugzilla.redhat.com/show_bug.cgi?id=2418361","https://github.com/redhat-developer/gitops-operator","https://github.com/redhat-developer/gitops-operator/releases/tag/v1.16.2"],"severity":{"label":"critical","score":9.1},"sources":[{"source":"osv","source_id":"GHSA-pcqx-8qww-7f4v","url":"https://osv.dev/vulnerability/GHSA-pcqx-8qww-7f4v"}],"summary":"OpenShift GitOps authenticated attackers can obtain cluster root access through forged ArgoCD custom resources"}