Technical impact
The OpenShift Pipelines operator includes a ClusterRoleBinding named tekton-scheduler-rolebinding that, due to an incorrect permission assignment (CWE-732), grants the system:authenticated group write access to Kueue and cert‑manager custom resources. An attacker who is only authenticated to the cluster can therefore alter workload scheduling priorities, delete other tenants’ Workload objects, or force cert‑manager to overwrite TLS secrets, including the default ingress controller certificate, thereby compromising confidentiality, integrity, or availability of the cluster.
Affected Systems
This vulnerability affects Red Hat OpenShift Pipelines and related OpenShift Build products. No specific product versions are listed in the advisory, so the impact applies to any deployed instance of the OpenShift Pipelines operator, regardless of build version.
Risk and Exploitability
The CVSS score of 7.1 indicates high severity. The EPSS score is < 1%, indicating a low probability of exploitation, but the lack of a KEV listing does not diminish the potential for active exploitation, especially since any authenticated user can abuse the over‑privileged binding. The likely attack vector is a legitimate authenticated session; once authenticated, the attacker can exploit the binding without additional permissions. Because the operator’s reconciliation loop may revert manual changes, exploitation is still viable until the issue is formally fixed.
