CVE Intelligence
Analysis AI-assisted

CVE-2026-6388: ArgoCD Image Updater: cross-namespace privilege escalation via ImageUpdater resources

A flaw in ArgoCD Image Updater lets a user who can create or modify an ImageUpdater resource cross namespace boundaries in multi-tenant clusters. The record describes unauthorized image updates on applications owned by other tenants, leading to cross-namespace privilege escalation. The CNA rates it critical with CVSS 3.1 base score 9.1, while the record lists no fixed version and no confirmed exploitation appears in the sources consulted.

Published Oct 13, 2026 · Updated Oct 13, 2026 · Ler em português

Overview

A flaw in ArgoCD Image Updater, tracked as CVE-2026-6388, allows a user who can create or modify an ImageUpdater resource to act outside their own namespace in a multi-tenant cluster. The record attributes the issue to insufficient validation and assigns CWE-1220.

Impact

  • Unauthorized image updates on applications managed by other tenants.
  • Cross-namespace privilege escalation.
  • Reduced application integrity through unauthorized application updates.

The CNA scores the issue as critical with a CVSS 3.1 base score of 9.1 and vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:H/A:L. Read literally, the vector describes a network-reachable attack requiring low privileges, no user interaction, a scope change and high integrity impact.

Affected products and versions

The record lists no affected product versions. Review the Red Hat CVE page and the Red Hat Bugzilla entry for vendor scoping before drawing conclusions about exposure.

Exploitation status

The record does not list this CVE in the CISA KEV catalog. No confirmed exploitation appears in the sources consulted. The EPSS probability is 0.00408 with a percentile of 0.33222.

Remediation and mitigation

  • Check the vendor advisory for a fixed ArgoCD Image Updater release, since none is listed in this record.
  • Until a fix is confirmed, review who holds permissions to create or modify ImageUpdater resources and remove access that is not needed.
  • In multi-tenant clusters, review namespace isolation and role bindings that could let one tenant affect another tenant's applications.
  • Narrow the scope of automatic image updates where operationally feasible.

Detection guidance

  • Audit create and modify events for ImageUpdater resources, especially those that reference namespaces outside the requesting tenant.
  • Monitor production applications for unexpected image changes and correlate them with approved change records.
  • Alert on role binding changes that grant write access to ImageUpdater resources.

Limitations of the available information

The record does not include affected versions, fixed versions, a CWE name or a vendor remediation path. The CVSS data comes from the CNA, and the record's source status is Awaiting Analysis. Exploitability beyond what the description states is not established.

Frequently asked questions

Is CVE-2026-6388 being actively exploited?

The record does not list it in CISA KEV, and no confirmed exploitation appears in the sources consulted. Keep monitoring vendor advisories for changes.

Which versions are affected?

The record does not list affected or fixed versions. Check the Red Hat CVE page for vendor updates.

Who should be most concerned?

Based on the description, multi-tenant environments where users can create or modify ImageUpdater resources are the main concern.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.