CVE-2026-10840: OpenShift Pipelines RBAC Privilege Escalation Vulnerability

Technical summary

The vulnerability exists because the tekton-scheduler-role ClusterRole, bound via the tekton-scheduler-rolebinding ClusterRoleBinding to the system:authenticated group, grants write permissions on Kueue WorkloadQueues and cert-manager Certificate/Secret resources. This violates the principle of least privilege: scheduler components should never expose write access to workload queues or certificate infrastructure to all authenticated users. The attack surface expands only when Kueue or cert-manager CRDs are deployed on the cluster; however, both are common in production OpenShift environments. An authenticated attacker can invoke kubectl or the Kubernetes API directly to modify or delete these resources, disrupting scheduling fairness and potentially achieving persistent access through certificate manipulation.

Business impact

In production environments, this vulnerability enables denial of service against scheduled workloads, unfair resource allocation, and supply-chain risk through certificate tampering. Multi-tenant clusters face the greatest risk: a malicious tenant or compromised low-privilege account can sabotage competing workloads or inject rogue certificates into the ingress chain. If the default ingress controller certificate is overwritten, external clients may experience service disruption or man-in-the-middle exposure until remediation. Organizations relying on Kueue for fair job queuing and scheduling lose enforcement guarantees.

Affected systems

OpenShift Pipelines operator deployments with either Kueue or cert-manager installed are affected. The vulnerability does not require specific Pipelines operator version constraints—any version using the tekton-scheduler-rolebinding is at risk. The impact is conditional: the vulnerability exists at deployment time but is only exploitable if the Kueue or cert-manager CRDs are present. Verify your OpenShift Pipelines operator version and check whether Kueue and cert-manager are installed in your cluster.

Exploitability

Exploitability is moderate to high. An attacker requires only valid cluster authentication credentials, which are often distributed broadly in DevOps environments (CI/CD service accounts, developer kubeconfigs, etc.). No special privileges, user interaction, or complex attack chains are needed—an attacker simply invokes API calls against Kueue or cert-manager resources. The CVSS score of 7.1 reflects the combination of network accessibility, low attack complexity, and high availability/integrity impact. However, the vulnerability does not yet appear on the CISA Known Exploited Vulnerabilities (KEV) catalog, suggesting active exploitation in the wild is not yet widespread.

Remediation

Immediately review and restrict the tekton-scheduler-rolebinding to only the minimum required subjects (e.g., the tekton-scheduler ServiceAccount itself, not the entire system:authenticated group). If Kueue or cert-manager are not required, uninstall them to eliminate the attack surface. Apply vendor patches or use NetworkPolicies and RBAC audit logging to monitor for unauthorized access. Verify against the OpenShift security advisory and vendor guidance for the exact remediation steps and any available operator updates.

Patch guidance

Consult the official Red Hat OpenShift Pipelines security advisory for the recommended operator version and patched ClusterRole definition. The patch should remove or significantly restrict write access from system:authenticated to Kueue and cert-manager resources. Verify that the updated ClusterRole grants only the minimum permissions necessary for the tekton-scheduler ServiceAccount to function. Test the patch in a staging environment to confirm scheduling workloads and certificate operations continue as expected. Review your RBAC policies post-patch to ensure no custom bindings reintroduce the same privilege escalation.

Detection guidance

Enable Kubernetes audit logging at the RequestResponse level and monitor for write operations (verbs: create, update, patch, delete) targeting Workload, Queue, Certificate, and Secret resources by users or service accounts that are not the tekton-scheduler ServiceAccount or cert-manager operator itself. Set up alerts for unexpected API calls to these resource types from unauthenticated or low-privilege identities. Use tools like Falco or kubectltrack to detect unusual kubectl or API-based manipulation. Examine your RBAC policies with kubectl get rolebinding,clusterrolebinding -A -o wide and verify that no overly permissive bindings remain post-remediation.

Why prioritize this

This vulnerability should be prioritized in multi-tenant or high-security-posture clusters because it enables privilege escalation and denial of service with minimal attacker effort. The combination of network accessibility, low attack complexity, and the ability to disrupt critical workload scheduling or overwrite TLS certificates justifies urgent remediation. Organizations with strict least-privilege policies or regulatory compliance requirements (e.g., zero-trust architectures) should patch immediately. If your cluster does not use Kueue or cert-manager, the risk is mitigated, but you should still apply patches as a defense-in-depth measure.

Risk score, explained

The CVSS 3.1 score of 7.1 (HIGH) reflects: (1) network-accessible attack vector via the Kubernetes API, (2) low attack complexity requiring only valid authentication, (3) low privilege requirements (any system:authenticated user), (4) no user interaction needed, (5) no confidentiality impact, (6) low integrity impact (selective tampering), and (7) high availability impact (workload disruption, service unavailability). The score appropriately penalizes the ease of exploitation and the severity of denial-of-service outcomes.

Frequently asked questions