CVE-2026-10840: OpenShift Pipelines Operator RBAC Misconfiguration – Unauthorized Workload & Certificate Access

Technical summary

CVE-2026-10840 involves an overly permissive ClusterRoleBinding (tekton-scheduler-rolebinding) that associates the tekton-scheduler-role ClusterRole with the system:authenticated group. This grants write access to Kueue and cert-manager custom resources. Any user with valid cluster credentials can invoke write operations on these CRDs, manipulating workload scheduling behavior, modifying Workload objects belonging to other tenants, or triggering cert-manager to overwrite TLS Secrets. The vulnerability stems from CWE-732 (Incorrect Permission Assignment), where the role scope is too broad relative to the principle of least privilege.

Business impact

Operational continuity is at risk. Authenticated attackers can delay or prevent legitimate workloads from executing, starve critical applications of resources by manipulating scheduling priorities, or erase other teams' job definitions. Additionally, TLS certificate tampering—especially overwriting ingress controller certificates—can break external service access, trigger SSL errors for end users, and potentially enable man-in-the-middle attacks. In multi-tenant environments, this enables cross-tenant interference and data exposure.

Affected systems

OpenShift Pipelines operator installations are affected. The vulnerability manifests only when Kueue or cert-manager CRDs are present on the cluster. Organizations running OpenShift with Pipelines, Kueue for workload management, and cert-manager for certificate automation are at highest risk. Single-tenant or isolated lab clusters without these components are not exposed to the full impact.

Exploitability

Exploitability is straightforward for any authenticated cluster user. No special elevation, complex exploitation chains, or zero-days are required—the attacker simply needs valid credentials (PR:L). The attack is network-accessible (AV:N) and requires no user interaction (UI:N). Attack complexity is low (AC:L). The primary barrier is cluster authentication; once inside, the abuse is trivial. Organizations using OpenShift with default RBAC and broad authentication groups amplify risk.

Remediation

Remove or restrict the overly permissive tekton-scheduler-rolebinding. Audit the tekton-scheduler-role to limit write access to Kueue and cert-manager CRDs only to dedicated service accounts that legitimately manage scheduling. Apply the principle of least privilege by binding the role only to specific ServiceAccounts rather than system:authenticated. Verify that cert-manager secrets are protected via additional RBAC rules and that scheduling decisions cannot be overwritten by untrusted users. Monitor cluster events for unauthorized Workload deletions or Secret modifications.

Patch guidance

Consult the OpenShift Pipelines operator release notes and Red Hat security advisories for patched versions. Verify the vendor advisory for explicit version numbers and update timelines. In the interim, implement manual RBAC corrections: recreate the tekton-scheduler-rolebinding to reference only necessary ServiceAccounts, or delete it entirely if Pipelines does not require cluster-wide scheduler role access. Test changes in a non-production environment first to ensure scheduling operations continue as expected.

Detection guidance

Monitor Kubernetes audit logs for write operations on Kueue Workload objects or cert-manager Certificate/Secret resources initiated by users outside the system:serviceaccount:* namespace. Watch for rapid deletions of Workload objects or unexpected modifications to TLS Secrets, particularly ingress-related certificates. Set up alerts on ClusterRoleBinding changes involving system:authenticated. Review RBAC policies regularly and cross-reference with your Pipelines deployment to catch misconfigurations. Use tools like kubectl auth can-i to simulate whether unexpected users can write to these resources.

Why prioritize this

HIGH severity (CVSS 7.1) reflects significant availability and integrity risk. While confidentiality is not directly impacted, the ability to disrupt scheduling, delete workloads, and tamper with certificates creates widespread operational harm. In production environments running multi-tenant Pipelines workloads, prioritize remediation within 2–4 weeks. The low barrier to exploitation (any authenticated user) and the cluster-scoped nature of the vulnerability elevate urgency, especially if Kueue and cert-manager are actively used.

Risk score, explained

The CVSS 3.1 score of 7.1 (HIGH) is driven by: (1) Low attack complexity and no required user interaction, making exploitation trivial once authenticated; (2) Integrity impact via Workload and Secret manipulation, causing data loss or service misconfiguration; (3) High availability impact from workload deletion and scheduling disruption; (4) Network accessibility broadens the threat surface; (5) Low privileges required—any authenticated user qualifies. The impact is scoped to the local system (S:U), as the attack does not break out of the cluster, but the effects are severe enough to warrant priority remediation in production.

Frequently asked questions