CVE-2026-14251: A flaw was found in the OpenShift GitOps operator. The ClusterRole reconciler does not validate resource ownership when reconciling ClusterRole objects. A namespace-scoped Argo CD
A flaw was found in the OpenShift GitOps operator. The ClusterRole reconciler does not validate resource ownership when reconciling ClusterRole objects. A namespace-scoped Argo CD instance can trigger deletion of a ClusterRole owned by a cluster-scoped Argo CD instance by crafting a name collision, resulting in a denial of service.
Details
Original advisory: https://nvd.nist.gov/vuln/detail/CVE-2026-14251
Exploitation outlook
EPSS (FIRST.org) estimates each CVE’s probability of exploitation in the next 30 days — here is the CSIRTS.com read on those numbers.
- Low exploitation riskCVE-2026-142510.22% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 13% of all scored CVEs.
Referenced CVEs
| CVE | CSIRTS overview | External |
|---|---|---|
| CVE-2026-14251 | coverage & exploitation status | NVD · CVE.org |
More from NVD Recent CVEs
- criticalCVE-2026-65321: PyAthena prior to 3.35.4 contains a sql injection vulnerability that allows unauthenticated at…2026-08-02
- lowCVE-2026-10774: Zephyr's Bluetooth Mesh subnet key management leaks one PSA Crypto key slot on every subnet-ke…2026-08-02
- mediumCVE-2026-68583: luci-app-adblock-fast before 1.2.4-4 contains a stored cross-site scripting vulnerability in t…2026-08-02
- mediumCVE-2026-68582: Vikunja versions >= 0.24.0 and <= 2.3.0 contain a broken object level authorization (BOLA) vul…2026-08-02
- highCVE-2026-68581: Vikunja versions 0.22.0 through 2.3.0 fail to validate the principal type in API token managem…2026-08-02