CVE-2026-107176 Cluster-samples-operator: role reads all secrets in openshift-config, not just pull-secret

Description

A flaw was found in the cluster-samples-operator. The RBAC Role coreos-pull-secret-reader in namespace openshift-config grants get, list, and watch permissions on all Secret resources without resourceNames scoping. The operator only requires access to the pull-secret Secret. If the samples-operator pod or its service account token is compromised through a separate vulnerability, an attacker could read all secrets in openshift-config, potentially including OAuth identity provider credentials, cloud provider credentials, and other sensitive cluster configuration.

Exploitable from the adjacent network, with an ordinary account and without any user action; an attacker can seriously compromise confidentiality, integrity or availability.

Attack vector

Adjacent network

Attack complexity

Low

Privileges required

Low

Interaction

None

Scope

Changed

Confidentiality

High

Integrity

None

Availability

None

Affected products and versions