Aller au contenu
Se connecter
7.1 Élevée

CVE-2026-10840 A flaw was found in the OpenShift Pipelines operator

Description

A flaw was found in the OpenShift Pipelines operator. The tekton-scheduler-rolebinding ClusterRoleBinding grants the system:authenticated group write access to Kueue and cert-manager custom resources via the tekton-scheduler-role ClusterRole. When Kueue or cert-manager CRDs are present on the cluster, any authenticated user can disrupt workload scheduling, tamper with scheduling priorities, delete other tenants' Workload objects, or induce cert-manager to overwrite TLS Secrets including the default ingress controller certificate.

Produits et versions touchés

Produit Versions touchées Corrigé en
Builds for Red Hat OpenShift Versions non publiées
OpenShift Pipelines Versions non publiées
Red Hat OpenShift Builds 1.7.4 1783341609 premières → < 1783341609 1783341609
Red Hat OpenShift Builds 1.8.1 1784121108 premières → < 1784121108 1784121108
Red Hat OpenShift Builds 1.7.1 1783341609 premières → < 1783341609 1783341609
Red Hat OpenShift Builds 1.7.2 1783341609 premières → < 1783341609 1783341609
Red Hat OpenShift Builds 1.8.0 1784121108 premières → < 1784121108 1784121108
Red Hat OpenShift Builds 1.7.3 1783341609 premières → < 1783341609 1783341609

Autres CVE de Builds for Red Hat OpenShift

Les 18 CVE de Builds for Red Hat OpenShift →
CVE-2026-50240 Pipelines-as-code: openshift-pipelines-operator-rh: pipelines-as-code: repository users can trigger namespace edit-equivalent execution via auto-provisioned pipeline serviceaccount 8.8 Élevée CVE-2026-27145 (*x509.Certificate).VerifyHostname previously called matchHostnames in a loop over all DNS Subject Alternative Name… 6.5 Moyenne CVE-2026-39821 The ToASCII and ToUnicode functions incorrectly accept Punycode-encoded labels that decode to an ASCII-only label 9.6 Critique CVE-2026-46595 Previously, CVE-2024-45337 fixed an authorization bypass for misused ssh server configurations; if any other type of… 10.0 Critique
Suivre cette CVE