CVE-2026-10840
HighCVSS 7.1Exploitation Probability (EPSS)
Low risk7th percentile - higher than 7% of all known CVEs
Summary
A flaw in the OpenShift Pipelines operator allows the 'tekton-scheduler-rolebinding' ClusterRoleBinding to grant the 'system:authenticated' group write access to Kueue and cert-manager custom resources. Any authenticated user can disrupt workload scheduling, delete other tenants' Workload objects, or overwrite TLS Secrets including the default ingress controller certificate.
Risk Assessment
The organization faces risks of workload disruption, scheduling priority tampering, and potential compromise of TLS certificates, which could lead to data breaches or man-in-the-middle attacks.
Recommendation
Immediately update the OpenShift Pipelines operator to a version that removes excessive permissions for the 'system:authenticated' group and restrict access to Kueue and cert-manager resources to trusted service accounts only.
Original NVD description (English source)
A flaw was found in the OpenShift Pipelines operator. The tekton-scheduler-rolebinding ClusterRoleBinding grants the system:authenticated group write access to Kueue and cert-manager custom resources via the tekton-scheduler-role ClusterRole. When Kueue or cert-manager CRDs are present on the cluster, any authenticated user can disrupt workload scheduling, tamper with scheduling priorities, delete other tenants' Workload objects, or induce cert-manager to overwrite TLS Secrets including the default ingress controller certificate.