Hi maintainers,
While auditing supported branches for CVE backports, I noticed that the fix for CVE-2025-13888 (PR #897, commit bc6ac3e0, "fix CVE namespace-isolation break") does not appear to be present on the v1.13 branch.
What I checked
- The
v1.13 branch HEAD does not contain the new symbols introduced by the fix:
userDefinedMonitoringLabel constant — not present in controllers/argocd_metrics_controller.go on v1.13openshift.io/user-monitoring label literal — not presentstrings.HasPrefix(namespace.Name, "openshift-") guard — not present
- The pre-fix code path (
namespace.Labels[clusterMonitoringLabel] = "true" unconditional) is still present.
git compare v1.13...bc6ac3e0 reports the branch is 16 commits behind the fix commit and the fix is not in the merged set.
Why this matters
Without the openshift- prefix guard, the operator may add the cluster-monitoring label to namespaces it shouldn't, which is the namespace-isolation issue described in the advisory. If v1.13 is still a supported maintenance branch, a cherry-pick of bc6ac3e0 (or an equivalent fix) would close that gap.
If v1.13 is no longer supported / EOL, please feel free to close — happy to know either way.
Thanks for your work on this project.
— @vulgraph
Hi maintainers,
While auditing supported branches for CVE backports, I noticed that the fix for CVE-2025-13888 (PR #897, commit
bc6ac3e0, "fix CVE namespace-isolation break") does not appear to be present on thev1.13branch.What I checked
v1.13branch HEAD does not contain the new symbols introduced by the fix:userDefinedMonitoringLabelconstant — not present incontrollers/argocd_metrics_controller.goonv1.13openshift.io/user-monitoringlabel literal — not presentstrings.HasPrefix(namespace.Name, "openshift-")guard — not presentnamespace.Labels[clusterMonitoringLabel] = "true"unconditional) is still present.git compare v1.13...bc6ac3e0reports the branch is 16 commits behind the fix commit and the fix is not in the merged set.Why this matters
Without the openshift- prefix guard, the operator may add the cluster-monitoring label to namespaces it shouldn't, which is the namespace-isolation issue described in the advisory. If
v1.13is still a supported maintenance branch, a cherry-pick ofbc6ac3e0(or an equivalent fix) would close that gap.If
v1.13is no longer supported / EOL, please feel free to close — happy to know either way.Thanks for your work on this project.
— @vulgraph