Hacktoberfest 2026: the issues maintainers tagged for October, open and beginner-friendly. Browse Hacktoberfest issues

Backport candidate: CVE-2025-13888 fix not present on v1.13 branch

Open
  • Is something wrong?
#1,139 0 comments 0 reactions 0 assignees View on GitHub

Maintainers usually reply within 1 day

Nobody has claimed this yet.

Assessment

Difficulty
3/5
Estimated time
1-2 days
Newbie friendliness
52/100
Issue type
Bug
Clarity
Mostly clear
Activity status
Quiet
Tech stack
go
Domain
release, security

Research direction

First verify whether the v1.13 branch is still supported. If it is, inspect controllers/argocd_metrics_controller.go on v1.13 and compare it with commit bc6ac3e0 from PR #897; done means the namespace-isolation fix is present on v1.13, or an equivalent backport is provided. If the branch is EOL, document that status instead.

Written by the indexing model from the issue text.

Description

Hi maintainers,

While auditing supported branches for CVE backports, I noticed that the fix for CVE-2025-13888 (PR #897, commit bc6ac3e0, "fix CVE namespace-isolation break") does not appear to be present on the v1.13 branch.

What I checked

  • The v1.13 branch HEAD does not contain the new symbols introduced by the fix:
    • userDefinedMonitoringLabel constant — not present in controllers/argocd_metrics_controller.go on v1.13
    • openshift.io/user-monitoring label literal — not present
    • strings.HasPrefix(namespace.Name, "openshift-") guard — not present
  • The pre-fix code path (namespace.Labels[clusterMonitoringLabel] = "true" unconditional) is still present.
  • git compare v1.13...bc6ac3e0 reports the branch is 16 commits behind the fix commit and the fix is not in the merged set.

Why this matters

Without the openshift- prefix guard, the operator may add the cluster-monitoring label to namespaces it shouldn't, which is the namespace-isolation issue described in the advisory. If v1.13 is still a supported maintenance branch, a cherry-pick of bc6ac3e0 (or an equivalent fix) would close that gap.

If v1.13 is no longer supported / EOL, please feel free to close — happy to know either way.

Thanks for your work on this project.

— @vulgraph

Dominant language
Go
Stars
188
Forks
359
Avg merge
4d 6h
Merged PRs (30d)
27

Getting set up

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

More from redhat-developer/gitops-operator

All issues in redhat-developer/gitops-operator

Similar issues

More Go issues

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.