CVE-2026-10843: OpenShift Cloud Credential Operator AWS IAM Over-Permissioning Vulnerability

Technical summary

CVE-2026-10843 affects the OpenShift Cloud Credential Operator in Mint mode, which dynamically provisions temporary AWS IAM credentials for cluster operations. The vulnerability stems from overly permissive IAM policy configuration that grants destructive action permissions at account scope rather than restricting them to cluster-owned resources via resource-based conditions or explicit ARN whitelisting. An attacker who obtains operator credentials—through pod compromise, service account token exfiltration, or RBAC misconfiguration—gains the ability to execute destructive IAM actions (DeleteUser, DeleteRole, PutUserPolicy, etc.) against any AWS resource in the account, circumventing the intended blast radius limitation.

Business impact

Compromise of operator credentials exposes the entire AWS account to destructive actions by a single attacker. This can result in: deletion of production infrastructure, persistent access through privilege escalation (creating new users/roles), data exfiltration via policy manipulation, and business continuity loss. For organizations running multiple clusters in a shared AWS account, the blast radius extends across all clusters. Recovery requires account-wide credential rotation, IAM audit, and restoration of deleted resources.

Affected systems

OpenShift deployments using the Cloud Credential Operator in Mint mode to manage AWS credentials are affected. Mint mode is the dynamic credential provisioning approach; Static and Passthrough modes are not impacted by this specific IAM scope issue. Organizations should verify their credential operator configuration and AWS IAM policies associated with OpenShift service accounts.

Exploitability

Exploitation requires obtaining operator credentials, which is non-trivial but feasible. Common vectors include: lateral movement from a compromised workload pod, exfiltration of service account tokens via RBAC misconfiguration, or insider access to Kubernetes secrets. Once credentials are obtained, exploitation is straightforward—the overly permissive policies allow immediate account-wide destructive actions without additional exploitation steps. The CVSS 3.1 score of 7.2 (HIGH) reflects high privileges required to obtain the credentials but high impact once obtained.

Remediation

Restrict operator IAM policies to cluster-owned resources using resource-based conditions and explicit ARN constraints. AWS IAM policy should explicitly limit destructive actions to resources tagged with cluster identifiers or within VPCs/security groups dedicated to the cluster. Review and audit all operator service account IAM policies for overly broad permissions. Consider using AWS permissions boundaries to enforce maximum permission scope at the operator role level. Organizations should also harden pod security policies to reduce the attack surface for credential compromise.

Patch guidance

Monitor Red Hat OpenShift security advisories and apply updates to the Cloud Credential Operator when available. Patches will likely tighten IAM policy generation in Mint mode to enforce resource-level scoping. Until patches are available, implement compensating controls by manually auditing and restricting the IAM policies attached to operator service accounts via CloudFormation or Terraform. Verify policy changes in a non-production environment before applying to production clusters.

Detection guidance

Monitor CloudTrail logs for destructive IAM actions (DeleteUser, DeleteRole, AttachUserPolicy, etc.) originating from OpenShift operator service account credentials or assumed roles. Alert on unusual IAM modifications that correlate with operator credential access patterns. Implement AWS Config rules to detect overly permissive IAM policies attached to service roles. In Kubernetes, monitor for suspicious service account token access or exfiltration attempts using RBAC audit logs and network policies. Scan operator pod logs for credential usage anomalies.

Why prioritize this

While the CVSS score is 7.2 (HIGH) and KEV status is not active, this vulnerability warrants rapid remediation due to its account-wide blast radius and the prevalence of shared AWS accounts in enterprise OpenShift environments. A single credential compromise can affect multiple clusters and teams. Organizations running OpenShift in Mint mode on AWS should prioritize policy review and patching immediately after updates are released.

Risk score, explained

CVSS 3.1 score of 7.2 reflects: Network-accessible operator (AV:N), low attack complexity once credentials are obtained (AC:L), high privileges required to initially compromise credentials (PR:H), account-wide destructive impact (C:H, I:H, A:H), and unchanged scope from the cluster context (S:U). The score appropriately weighs the difficulty of obtaining credentials against the catastrophic impact if they are compromised. Contextual risk is elevated for multi-tenant or multi-cluster AWS accounts.

Frequently asked questions