{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-10840", "assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749", "state": "PUBLISHED", "assignerShortName": "redhat", "dateReserved": "2026-06-04T11:29:18.169Z", "datePublished": "2026-06-04T12:04:42.823Z", "dateUpdated": "2026-06-04T12:04:42.823Z"}, "containers": {"cna": {"title": "Openshift-pipelines-operator-rh: openshift-pipelines-operator: tekton-scheduler-rolebinding grants system:authenticated write access to kueue and cert-manager resources", "metrics": [{"other": {"content": {"value": "Important", "namespace": "https://access.redhat.com/security/updates/classification/"}, "type": "Red Hat severity rating"}}, {"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.6, "baseSeverity": "CRITICAL", "confidentialityImpact": "NONE", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:H", "version": "3.1"}, "format": "CVSS"}], "descriptions": [{"lang": "en", "value": "A flaw was found in the OpenShift Pipelines operator. The tekton-scheduler-rolebinding ClusterRoleBinding grants the system:authenticated group write access to Kueue and cert-manager custom resources via the tekton-scheduler-role ClusterRole. When Kueue or cert-manager CRDs are present on the cluster, any authenticated user can disrupt workload scheduling, tamper with scheduling priorities, delete other tenants' Workload objects, or induce cert-manager to overwrite TLS Secrets including the default ingress controller certificate."}], "affected": [{"vendor": "Red Hat", "product": "Builds for Red Hat OpenShift", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "packageName": "openshift-builds/openshift-builds-rhel9-operator", "defaultStatus": "unknown", "cpes": ["cpe:/a:redhat:openshift_builds:1"]}, {"vendor": "Red Hat", "product": "OpenShift Pipelines", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "packageName": "openshift-pipelines/pipelines-operator-proxy-rhel8", "defaultStatus": "unknown", "cpes": ["cpe:/a:redhat:openshift_pipelines:1"]}, {"vendor": "Red Hat", "product": "OpenShift Pipelines", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "packageName": "openshift-pipelines/pipelines-operator-proxy-rhel9", "defaultStatus": "unknown", "cpes": ["cpe:/a:redhat:openshift_pipelines:1"]}, {"vendor": "Red Hat", "product": "OpenShift Pipelines", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "packageName": "openshift-pipelines/pipelines-operator-webhook-rhel8", "defaultStatus": "unknown", "cpes": ["cpe:/a:redhat:openshift_pipelines:1"]}, {"vendor": "Red Hat", "product": "OpenShift Pipelines", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "packageName": "openshift-pipelines/pipelines-operator-webhook-rhel9", "defaultStatus": "unknown", "cpes": ["cpe:/a:redhat:openshift_pipelines:1"]}, {"vendor": "Red Hat", "product": "OpenShift Pipelines", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "packageName": "openshift-pipelines/pipelines-rhel8-operator", "defaultStatus": "unknown", "cpes": ["cpe:/a:redhat:openshift_pipelines:1"]}, {"vendor": "Red Hat", "product": "OpenShift Pipelines", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "packageName": "openshift-pipelines/pipelines-rhel9-operator", "defaultStatus": "unknown", "cpes": ["cpe:/a:redhat:openshift_pipelines:1"]}], "references": [{"url": "https://access.redhat.com/security/cve/CVE-2026-10840", "tags": ["vdb-entry", "x_refsource_REDHAT"]}, {"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2484720", "name": "RHBZ#2484720", "tags": ["issue-tracking", "x_refsource_REDHAT"]}], "datePublic": "2026-04-25T00:00:00.000Z", "problemTypes": [{"descriptions": [{"cweId": "CWE-732", "description": "Incorrect Permission Assignment for Critical Resource", "lang": "en", "type": "CWE"}]}], "x_redhatCweChain": "CWE-732: Incorrect Permission Assignment for Critical Resource", "workarounds": [{"lang": "en", "value": "If the Tekton Scheduler feature is not in use, administrators can mitigate this by patching the ClusterRoleBinding to reference a specific ServiceAccount instead of system:authenticated:\n\noc patch clusterrolebinding tekton-scheduler-rolebinding --type=merge -p '{\"subjects\": [{\"kind\": \"ServiceAccount\", \"name\": \"openshift-pipelines-operator\", \"namespace\": \"openshift-operators\"}]}'\n\nIMPORTANT: The OpenShift Pipelines operator's reconciliation loop may revert this manual patch. Verify that the operator does not reconcile this binding back to system:authenticated after applying the mitigation. If it does, scale down the operator deployment or configure the operator to skip reconciliation of this object.\n\nAlternatively, the ClusterRoleBinding can be deleted if the Tekton Scheduler is not enabled."}], "timeline": [{"lang": "en", "time": "2026-04-25T00:00:00.000Z", "value": "Reported to Red Hat."}, {"lang": "en", "time": "2026-04-25T00:00:00.000Z", "value": "Made public."}], "credits": [{"lang": "en", "value": "Red Hat would like to thank Christopher Lusk (North Echo Security Research) for reporting this issue."}], "providerMetadata": {"orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749", "shortName": "redhat", "dateUpdated": "2026-06-04T12:04:42.823Z"}, "x_generator": {"engine": "cvelib 1.8.0"}}}}

{}

{"cveTags": [], "descriptions": [{"lang": "en", "value": "A flaw was found in the OpenShift Pipelines operator. The tekton-scheduler-rolebinding ClusterRoleBinding grants the system:authenticated group write access to Kueue and cert-manager custom resources via the tekton-scheduler-role ClusterRole. When Kueue or cert-manager CRDs are present on the cluster, any authenticated user can disrupt workload scheduling, tamper with scheduling priorities, delete other tenants' Workload objects, or induce cert-manager to overwrite TLS Secrets including the default ingress controller certificate."}], "id": "CVE-2026-10840", "lastModified": "2026-06-04T12:16:24.813", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.6, "baseSeverity": "CRITICAL", "confidentialityImpact": "NONE", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 3.1, "impactScore": 5.8, "source": "secalert@redhat.com", "type": "Primary"}]}, "published": "2026-06-04T12:16:24.813", "references": [{"source": "secalert@redhat.com", "url": "https://access.redhat.com/security/cve/CVE-2026-10840"}, {"source": "secalert@redhat.com", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2484720"}], "sourceIdentifier": "secalert@redhat.com", "vulnStatus": "Received", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-732"}], "source": "secalert@redhat.com", "type": "Primary"}]}

{}

{}