A flaw in the cluster‑samples‑operator grants the RBAC Role coreos‑pull‑secret‑reader get, list, and watch privileges on every Secret within the openshift‑config namespace because it lacks a resourceNames restriction. Although the operator only requires access to the pull‑secret Secret, the over‑permissive role enables an attacker who compromises the samples‑operator pod or its service‑account token through another vulnerability to read all secrets, including OAuth identity provider credentials, cloud provider keys, and other sensitive cluster configuration data.

The vulnerability affects Red Hat OpenShift Container Platform 4, specifically the cluster‑samples‑operator component that runs in the openshift‑config namespace. No precise version numbers are provided, so the flaw applies to all installed instances of the operator within OpenShift 4.x that rely on the default coreos‑pull‑secret‑reader role.

The CVSS score of 6.8 indicates the issue is of medium severity. EPSS data is not available and the vulnerability is not listed in the CISA KEV catalog, suggesting no known active exploitation in the wild. However, the attack requires a separate prerequisite that the samples‑operator pod or its service‑account token be compromised, after which the attacker can read all secrets with no further action. This presents a confidentiality risk that could compromise authentication, authorization, and overall cluster security.