Skip to content
fr Sign in
7.1 High

CVE-2026-10840 A flaw was found in the OpenShift Pipelines operator

Description

A flaw was found in the OpenShift Pipelines operator. The tekton-scheduler-rolebinding ClusterRoleBinding grants the system:authenticated group write access to Kueue and cert-manager custom resources via the tekton-scheduler-role ClusterRole. When Kueue or cert-manager CRDs are present on the cluster, any authenticated user can disrupt workload scheduling, tamper with scheduling priorities, delete other tenants' Workload objects, or induce cert-manager to overwrite TLS Secrets including the default ingress controller certificate.

Affected products and versions

Product Affected versions Fixed in
Builds for Red Hat OpenShift Versions not published
OpenShift Pipelines Versions not published
Red Hat OpenShift Builds 1.7.4 1783341609 earliest → < 1783341609 1783341609
Red Hat OpenShift Builds 1.8.1 1784121108 earliest → < 1784121108 1784121108
Red Hat OpenShift Builds 1.7.1 1783341609 earliest → < 1783341609 1783341609
Red Hat OpenShift Builds 1.7.2 1783341609 earliest → < 1783341609 1783341609
Red Hat OpenShift Builds 1.8.0 1784121108 earliest → < 1784121108 1784121108
Red Hat OpenShift Builds 1.7.3 1783341609 earliest → < 1783341609 1783341609

References

Timeline

  1. Published
  2. Last modified

Other CVEs of Builds for Red Hat OpenShift

The 17 CVEs of Builds for Red Hat OpenShift →
CVE-2026-27145 (*x509.Certificate).VerifyHostname previously called matchHostnames in a loop over all DNS Subject Alternative Name… 6.5 Medium CVE-2026-39821 The ToASCII and ToUnicode functions incorrectly accept Punycode-encoded labels that decode to an ASCII-only label 9.6 Critical CVE-2026-39829 The RSA and DSA public key parsers did not enforce size limits on key parameters 7.5 High CVE-2026-42508 Previously, a revoked 'SignatureKey' belonging to a CA was not correctly checked for revocation 9.1 Critical
Track this CVE