Aller au contenu
en Se connecter
7.1 Élevée

CVE-2026-10840 A flaw was found in the OpenShift Pipelines operator

Description

A flaw was found in the OpenShift Pipelines operator. The tekton-scheduler-rolebinding ClusterRoleBinding grants the system:authenticated group write access to Kueue and cert-manager custom resources via the tekton-scheduler-role ClusterRole. When Kueue or cert-manager CRDs are present on the cluster, any authenticated user can disrupt workload scheduling, tamper with scheduling priorities, delete other tenants' Workload objects, or induce cert-manager to overwrite TLS Secrets including the default ingress controller certificate.

Produits et versions touchés

Produit Versions touchées Corrigé en
Builds for Red Hat OpenShift Versions non publiées
OpenShift Pipelines Versions non publiées
Red Hat OpenShift Builds 1.7.4 1783341609 premières → < 1783341609 1783341609
Red Hat OpenShift Builds 1.8.1 1784121108 premières → < 1784121108 1784121108
Red Hat OpenShift Builds 1.7.1 1783341609 premières → < 1783341609 1783341609
Red Hat OpenShift Builds 1.7.2 1783341609 premières → < 1783341609 1783341609
Red Hat OpenShift Builds 1.8.0 1784121108 premières → < 1784121108 1784121108
Red Hat OpenShift Builds 1.7.3 1783341609 premières → < 1783341609 1783341609

Références

Chronologie

  1. Publiée
  2. Dernière modification

Autres CVE de Builds for Red Hat OpenShift

Les 17 CVE de Builds for Red Hat OpenShift →
CVE-2026-27145 (*x509.Certificate).VerifyHostname previously called matchHostnames in a loop over all DNS Subject Alternative Name… 6.5 Moyenne CVE-2026-39821 The ToASCII and ToUnicode functions incorrectly accept Punycode-encoded labels that decode to an ASCII-only label 9.6 Critique CVE-2026-39829 The RSA and DSA public key parsers did not enforce size limits on key parameters 7.5 Élevée CVE-2026-42508 Previously, a revoked 'SignatureKey' belonging to a CA was not correctly checked for revocation 9.1 Critique
Suivre cette CVE