Skip to content
Fencer Vulns
medium 6.8

CVE-2026-107176 json

Cluster-samples-operator: role reads all secrets in openshift-config, not just pull-secret

published 2026-10-07 32 d ago modified 2026-11-04 4 d ago also EUVD-2026-94581

cvss
6.8
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
0.3%
EPSS 0.3% chance of exploitation in 30 days, percentile 20%
public exploits
0
none known

Summary

A flaw was found in the cluster-samples-operator. The RBAC Role coreos-pull-secret-reader in namespace openshift-config grants get, list, and watch permissions on all Secret resources without resourceNames scoping. The operator only requires access to the pull-secret Secret. If the samples-operator pod or its service account token is compromised through a separate vulnerability, an attacker could read all secrets in openshift-config, potentially including OAuth identity provider credentials, cloud provider credentials, and other sensitive cluster configuration.

Patch / fix

  • Red Hat Red Hat OpenShift Container Platform 4.19 1793123280
  • Red Hat Red Hat OpenShift Container Platform 4.20 1792826398
  • Red Hat Red Hat OpenShift Container Platform 4.21 1792852494
  • Red Hat Red Hat OpenShift Container Platform 4.22 1792770602

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2026-107176 updated cvss 6.8

cluster-samples-operator: Role reads ALL secrets in openshift-config, not just pull-secret

  • Red Hat OpenShift Container Platform 4 openshift4/ose-cluster-samples-operator Red Hat OpenShift Container Platform 5 openshift5/ose-cluster-samples-rhel9-operator
    affected: workaround, no fix available
  • Red Hat OpenShift Container Platform 4.19 openshift4/ose-cluster-samples-rhel9-operator 1793123280
    fixed: vendor fix RHSA-2026:92280
  • Red Hat OpenShift Container Platform 4.20 openshift4/ose-cluster-samples-rhel9-operator 1792826398
    fixed: vendor fix RHSA-2026:89341
  • Red Hat OpenShift Container Platform 4.21 openshift4/ose-cluster-samples-rhel9-operator 1792852494
    fixed: vendor fix RHSA-2026:89626
  • Red Hat OpenShift Container Platform 4.22 openshift4/ose-cluster-samples-rhel9-operator 1792770602
    fixed: vendor fix RHSA-2026:89198
  • Red Hat OpenShift Container Platform 4.19 openshift4/frr-rhel9 1793115830, openshift4/ose-cli-rhel9 1793127475, openshift4/ose-pod-rhel9 1793126120, openshift4/ose-etcd-rhel9 1793123386, openshift4/ose-tests-rhel9 1793165019, openshift4/ose-tools-rhel9 1793163564, +180 more Red Hat OpenShift Container Platform 4.20 openshift4/frr-rhel9 1792849940, openshift4/ose-cli-rhel9 1792849481, openshift4/ose-pod-rhel9 1792825995, openshift4/ose-etcd-rhel9 1792825148, openshift4/ose-tests-rhel9 1792851596, openshift4/ose-tools-rhel9 1792849604, +182 more Red Hat OpenShift Container Platform 4.21 openshift4/frr-rhel9 1792853629, openshift4/ose-cli-rhel9 1792852519, openshift4/ose-pod-rhel9 1792854942, openshift4/ose-etcd-rhel9 1792852783, openshift4/ose-tests-rhel9 1792855964, openshift4/ose-tools-rhel9 1792852899, +181 more Red Hat OpenShift Container Platform 4.22 openshift4/frr-rhel9 1792844305, openshift4/ose-cli-rhel9 1792854321, openshift4/ose-pod-rhel9 1792855800, openshift4/ose-etcd-rhel9 1792769386, openshift4/ose-tests-rhel9 1792844569, openshift4/ose-tools-rhel9 1792769417, +182 more
    not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation
none
Automatable
no
Technical impact
partial
Assessed
32 d ago

Exploit prediction

0.27% chance of exploitation in the next 30 days, higher than 20% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
CNA 3.1 6.8 CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N

Affected products

  • Red Hat Red Hat OpenShift Container Platform 4.19
  • Red Hat Red Hat OpenShift Container Platform 4.20
  • Red Hat Red Hat OpenShift Container Platform 4.21
  • Red Hat Red Hat OpenShift Container Platform 4.22
  • Red Hat Red Hat OpenShift Container Platform 4
  • Red Hat Red Hat OpenShift Container Platform 5

Classification

Weakness
  • CWE-250 Execution with Unnecessary Privileges

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.