Skip to content
Fencer Vulns
high 7.1

CVE-2026-10840 json

Openshift-pipelines-operator-rh: openshift-pipelines-operator: tekton-scheduler-rolebinding grants system:authenticated write access to kueue and cert-manager resources

published 2026-06-04 5 mo ago modified 2026-09-07 2 mo ago also EUVD-2026-34248

cvss
7.1
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
0.2%
EPSS 0.2% chance of exploitation in 30 days, percentile 12%
public exploits
0
none known

Summary

A flaw was found in the OpenShift Pipelines operator. The tekton-scheduler-rolebinding ClusterRoleBinding grants the system:authenticated group write access to Kueue and cert-manager custom resources via the tekton-scheduler-role ClusterRole. When Kueue or cert-manager CRDs are present on the cluster, any authenticated user can disrupt workload scheduling, tamper with scheduling priorities, delete other tenants' Workload objects, or induce cert-manager to overwrite TLS Secrets including the default ingress controller certificate.

Patch / fix

  • Red Hat Red Hat OpenShift Builds 1.7.3 1783341609
  • Red Hat Red Hat OpenShift Builds 1.8.1 1784121108

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2026-10840 updated cvss 7.1

openshift-pipelines-operator-rh: openshift-pipelines-operator: tekton-scheduler-rolebinding grants system:authenticated write access to Kueue and cert-manager resources

  • Red Hat OpenShift Pipelines openshift-pipelines/pipelines-rhel9-operator, openshift-pipelines/pipelines-operator-proxy-rhel9, openshift-pipelines/pipelines-operator-webhook-rhel8, openshift-pipelines/pipelines-operator-webhook-rhel9
    affected: workaround, no fix available
  • Red Hat OpenShift Builds 1.7.3 openshift-builds/openshift-builds-rhel9-operator 1783341609
    fixed: fixed in 1.7.4 RHSA-2026:36648
  • Red Hat OpenShift Builds 1.8.1 openshift-builds/openshift-builds-rhel9-operator 1784121108
    fixed: fixed in 1.8.1 RHSA-2026:41036
  • Red Hat OpenShift Pipelines openshift-pipelines/pipelines-rhel8-operator, openshift-pipelines/pipelines-operator-proxy-rhel8 Red Hat OpenShift Builds 1.7.3 openshift-builds/openshift-builds-waiters-rhel9 1783057868, openshift-builds/openshift-builds-webhook-rhel9 1783058284, openshift-builds/openshift-builds-operator-bundle 1783413402, openshift-builds/openshift-builds-controller-rhel9 1783057515, openshift-builds/openshift-builds-git-cloner-rhel9 1783057529, openshift-builds/openshift-builds-image-bundler-rhel9 1783057884, +3 more Red Hat OpenShift Builds 1.8.1 openshift-builds/openshift-builds-waiters-rhel9 1783612119, openshift-builds/openshift-builds-webhook-rhel9 1783612163, openshift-builds/openshift-builds-operator-bundle 1784191184, openshift-builds/openshift-builds-controller-rhel9 1783612432, openshift-builds/openshift-builds-git-cloner-rhel9 1783611973, openshift-builds/openshift-builds-image-bundler-rhel9 1783612714, +3 more
    not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation
none
Automatable
no
Technical impact
partial
Assessed
5 mo ago

Exploit prediction

0.22% chance of exploitation in the next 30 days, higher than 12% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
CNA 3.1 7.1 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H
CISA ADP 3.1 7.1 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H

Affected products

  • Red Hat Red Hat OpenShift Builds 1.7.3
  • Red Hat Red Hat OpenShift Builds 1.8.1
  • Red Hat OpenShift Pipelines

Classification

Weakness
  • CWE-732 Incorrect Permission Assignment for Critical Resource

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.