CVE-2026-15584

Redhatinsights/incluster-checks: incluster-checks: privileged host-chroot debug pods created in shared default namespace enable privilege escalation to node root

View on CVE.org
Published Jul 13, 2026 CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Description
A privilege escalation vulnerability was found in the incluster-checks tool for OpenShift. The tool creates privileged debug pods with host filesystem access in the shared default namespace, where any user with the standard edit role can exec into them and obtain root access on cluster nodes.

Analysis

AI-generated

Technical impact

A privilege escalation vulnerability has been discovered in the incluster‑checks tool used with OpenShift. The tool automatically creates privileged debug pods that mount the host file system into the shared default namespace. Any user with the standard edit role can exec into these pods, thereby gaining root permissions on the underlying cluster node. This flaw is an example of CWE‑250: Unnecessary Privilege.

Affected Systems

The affected product is the incluster‑checks component that ships with Red Hat’s Pen Drive Powered by Red Hat Lightspeed, currently at release version 1. It impacts OpenShift clusters that have the incluster‑checks tool enabled and expose the default namespace to users granted the edit role.

Risk and Exploitability

The CVSS score of 7.5 indicates a substantial impact, but the EPSS score of less than 1 % shows a very low global exploitation likelihood. Based on the description, it is inferred that the attack vector requires only standard edit rights on the default namespace, a common permission assignment, so the vulnerability can be leveraged within a compromised cluster. The vulnerability is not listed in the CISA KEV, yet the ability to reach node root makes it a serious risk for cluster administrators.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade the incluster‑checks tool to the patched release that no longer creates privileged debug pods with host filesystem access.
  • Restrict the edit role on the default namespace so that only trusted users can create or exec into pods, eliminating the privilege escalation path.
  • Apply or enforce OpenShift Security Context Constraints that disallow privileged containers and host filesystem access for debug pods, preventing the creation of vulnerable pods.

Generated by OpenCVE AI on July 31, 2026 at 11:38 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories available
History
Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}
Type Values Removed Values Added
Description A privilege escalation vulnerability was found in the incluster-checks tool for OpenShift. The tool creates privileged debug pods with host filesystem access in the shared default namespace, where any user with the standard edit role can exec into them and obtain root access on cluster nodes.
Title Redhatinsights/incluster-checks: incluster-checks: privileged host-chroot debug pods created in shared default namespace enable privilege escalation to node root
First Time appeared Redhat
Redhat pdrive Lightspeed
Weaknesses CWE-250
CPEs cpe:/a:redhat:pdrive_lightspeed:1
Vendors & Products Redhat
Redhat pdrive Lightspeed
References
Metrics cvssV3_1

{'score': 7.5, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H'}
Weaknesses
  • CWE-250

    Execution with Unnecessary Privileges

Sources

Status
PUBLISHED
Assigner
redhat
Published
Updated
Jul 14, 2026, 2:32 PM
Reserved
Jul 13, 2026, 11:47 AM

View source JSON

Updated
Jul 14, 2026, 2:19 PM

JSON

Status
Awaiting Analysis
Published
Jul 13, 2026, 1:16 PM
Modified
Oct 24, 2026, 10:10 PM

View source JSON

No data.

Updated
Jul 31, 2026, 11:45 AM

JSON