CVE-2026-107176

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-107176", "assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749", "state": "PUBLISHED", "assignerShortName": "redhat", "dateReserved": "2026-10-07T12:39:11.178Z", "datePublished": "2026-10-07T19:29:31.293Z", "dateUpdated": "2026-11-04T15:57:08.405Z"}, "containers": {"cna": {"title": "Cluster-samples-operator: role reads all secrets in openshift-config, not just pull-secret", "metrics": [{"other": {"content": {"value": "Moderate", "namespace": "https://access.redhat.com/security/updates/classification/"}, "type": "Red Hat severity rating"}}, {"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "ADJACENT_NETWORK", "availabilityImpact": "NONE", "baseScore": 6.8, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N", "version": "3.1"}, "format": "CVSS"}], "descriptions": [{"lang": "en", "value": "A flaw was found in the cluster-samples-operator. The RBAC Role coreos-pull-secret-reader in namespace openshift-config grants get, list, and watch permissions on all Secret resources without resourceNames scoping. The operator only requires access to the pull-secret Secret. If the samples-operator pod or its service account token is compromised through a separate vulnerability, an attacker could read all secrets in openshift-config, potentially including OAuth identity provider credentials, cloud provider credentials, and other sensitive cluster configuration."}], "affected": [{"vendor": "Red Hat", "product": "Red Hat OpenShift Container Platform 4.19", "collectionURL": "https://catalog.redhat.com/software/containers/", "packageName": "openshift4/ose-cluster-samples-rhel9-operator", "defaultStatus": "affected", "versions": [{"version": "1793123280", "lessThan": "*", "versionType": "rpm", "status": "unaffected"}], "cpes": ["cpe:/a:redhat:openshift:4.19::el9"]}, {"vendor": "Red Hat", "product": "Red Hat OpenShift Container Platform 4.20", "collectionURL": "https://catalog.redhat.com/software/containers/", "packageName": "openshift4/ose-cluster-samples-rhel9-operator", "defaultStatus": "affected", "versions": [{"version": "1792826398", "lessThan": "*", "versionType": "rpm", "status": "unaffected"}], "cpes": ["cpe:/a:redhat:openshift:4.20::el9"]}, {"vendor": "Red Hat", "product": "Red Hat OpenShift Container Platform 4.21", "collectionURL": "https://catalog.redhat.com/software/containers/", "packageName": "openshift4/ose-cluster-samples-rhel9-operator", "defaultStatus": "affected", "versions": [{"version": "1792852494", "lessThan": "*", "versionType": "rpm", "status": "unaffected"}], "cpes": ["cpe:/a:redhat:openshift:4.21::el9"]}, {"vendor": "Red Hat", "product": "Red Hat OpenShift Container Platform 4.22", "collectionURL": "https://catalog.redhat.com/software/containers/", "packageName": "openshift4/ose-cluster-samples-rhel9-operator", "defaultStatus": "affected", "versions": [{"version": "1792770602", "lessThan": "*", "versionType": "rpm", "status": "unaffected"}], "cpes": ["cpe:/a:redhat:openshift:4.22::el9"]}, {"vendor": "Red Hat", "product": "Red Hat OpenShift Container Platform 4", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "packageName": "openshift4/ose-cluster-samples-operator", "defaultStatus": "affected", "cpes": ["cpe:/a:redhat:openshift:4"]}, {"vendor": "Red Hat", "product": "Red Hat OpenShift Container Platform 5", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "packageName": "openshift5/ose-cluster-samples-rhel9-operator", "defaultStatus": "affected", "cpes": ["cpe:/a:redhat:openshift:5"]}], "references": [{"url": "https://access.redhat.com/errata/RHSA-2026:89198", "name": "RHSA-2026:89198", "tags": ["vendor-advisory", "x_refsource_REDHAT"]}, {"url": "https://access.redhat.com/errata/RHSA-2026:89341", "name": "RHSA-2026:89341", "tags": ["vendor-advisory", "x_refsource_REDHAT"]}, {"url": "https://access.redhat.com/errata/RHSA-2026:89626", "name": "RHSA-2026:89626", "tags": ["vendor-advisory", "x_refsource_REDHAT"]}, {"url": "https://access.redhat.com/errata/RHSA-2026:92280", "name": "RHSA-2026:92280", "tags": ["vendor-advisory", "x_refsource_REDHAT"]}, {"url": "https://access.redhat.com/security/cve/CVE-2026-107176", "tags": ["vdb-entry", "x_refsource_REDHAT"]}, {"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2523035", "name": "RHBZ#2523035", "tags": ["issue-tracking", "x_refsource_REDHAT"]}], "datePublic": "2026-10-07T00:00:00.000Z", "problemTypes": [{"descriptions": [{"cweId": "CWE-250", "description": "Execution with Unnecessary Privileges", "lang": "en", "type": "CWE"}]}], "x_redhatCweChain": "CWE-250: Execution with Unnecessary Privileges", "workarounds": [{"lang": "en", "value": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."}], "timeline": [{"lang": "en", "time": "2026-08-24T19:25:31.000Z", "value": "Reported to Red Hat."}, {"lang": "en", "time": "2026-10-07T00:00:00.000Z", "value": "Made public."}], "providerMetadata": {"orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749", "shortName": "redhat", "dateUpdated": "2026-11-04T15:57:08.405Z"}, "x_generator": {"engine": "cvelib 1.8.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-10-07T19:59:03.424144Z", "id": "CVE-2026-107176", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-07T19:59:13.232Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-107176", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-10-07T19:59:03.424144Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-07T19:59:09.327Z"}}], "cna": {"title": "Cluster-samples-operator: role reads all secrets in openshift-config, not just pull-secret", "metrics": [{"other": {"type": "Red Hat severity rating", "content": {"value": "Moderate", "namespace": "https://access.redhat.com/security/updates/classification/"}}}, {"format": "CVSS", "cvssV3_1": {"scope": "CHANGED", "version": "3.1", "baseScore": 6.8, "attackVector": "ADJACENT_NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}}], "affected": [{"cpes": ["cpe:/a:redhat:openshift:4.19::el9"], "vendor": "Red Hat", "product": "Red Hat OpenShift Container Platform 4.19", "versions": [{"status": "unaffected", "version": "1793123280", "lessThan": "*", "versionType": "rpm"}], "packageName": "openshift4/ose-cluster-samples-rhel9-operator", "collectionURL": "https://catalog.redhat.com/software/containers/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:openshift:4.20::el9"], "vendor": "Red Hat", "product": "Red Hat OpenShift Container Platform 4.20", "versions": [{"status": "unaffected", "version": "1792826398", "lessThan": "*", "versionType": "rpm"}], "packageName": "openshift4/ose-cluster-samples-rhel9-operator", "collectionURL": "https://catalog.redhat.com/software/containers/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:openshift:4.21::el9"], "vendor": "Red Hat", "product": "Red Hat OpenShift Container Platform 4.21", "versions": [{"status": "unaffected", "version": "1792852494", "lessThan": "*", "versionType": "rpm"}], "packageName": "openshift4/ose-cluster-samples-rhel9-operator", "collectionURL": "https://catalog.redhat.com/software/containers/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:openshift:4.22::el9"], "vendor": "Red Hat", "product": "Red Hat OpenShift Container Platform 4.22", "versions": [{"status": "unaffected", "version": "1792770602", "lessThan": "*", "versionType": "rpm"}], "packageName": "openshift4/ose-cluster-samples-rhel9-operator", "collectionURL": "https://catalog.redhat.com/software/containers/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:openshift:4"], "vendor": "Red Hat", "product": "Red Hat OpenShift Container Platform 4", "packageName": "openshift4/ose-cluster-samples-operator", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:openshift:5"], "vendor": "Red Hat", "product": "Red Hat OpenShift Container Platform 5", "packageName": "openshift5/ose-cluster-samples-rhel9-operator", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected"}], "timeline": [{"lang": "en", "time": "2026-08-24T19:25:31.000Z", "value": "Reported to Red Hat."}, {"lang": "en", "time": "2026-10-07T00:00:00.000Z", "value": "Made public."}], "datePublic": "2026-10-07T00:00:00.000Z", "references": [{"url": "https://access.redhat.com/errata/RHSA-2026:89198", "name": "RHSA-2026:89198", "tags": ["vendor-advisory", "x_refsource_REDHAT"]}, {"url": "https://access.redhat.com/errata/RHSA-2026:89341", "name": "RHSA-2026:89341", "tags": ["vendor-advisory", "x_refsource_REDHAT"]}, {"url": "https://access.redhat.com/errata/RHSA-2026:89626", "name": "RHSA-2026:89626", "tags": ["vendor-advisory", "x_refsource_REDHAT"]}, {"url": "https://access.redhat.com/errata/RHSA-2026:92280", "name": "RHSA-2026:92280", "tags": ["vendor-advisory", "x_refsource_REDHAT"]}, {"url": "https://access.redhat.com/security/cve/CVE-2026-107176", "tags": ["vdb-entry", "x_refsource_REDHAT"]}, {"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2523035", "name": "RHBZ#2523035", "tags": ["issue-tracking", "x_refsource_REDHAT"]}], "workarounds": [{"lang": "en", "value": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."}], "x_generator": {"engine": "cvelib 1.8.0"}, "descriptions": [{"lang": "en", "value": "A flaw was found in the cluster-samples-operator. The RBAC Role coreos-pull-secret-reader in namespace openshift-config grants get, list, and watch permissions on all Secret resources without resourceNames scoping. The operator only requires access to the pull-secret Secret. If the samples-operator pod or its service account token is compromised through a separate vulnerability, an attacker could read all secrets in openshift-config, potentially including OAuth identity provider credentials, cloud provider credentials, and other sensitive cluster configuration."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-250", "description": "Execution with Unnecessary Privileges"}]}], "providerMetadata": {"orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749", "shortName": "redhat", "dateUpdated": "2026-11-04T15:57:08.405Z"}, "x_redhatCweChain": "CWE-250: Execution with Unnecessary Privileges"}}, "cveMetadata": {"cveId": "CVE-2026-107176", "state": "PUBLISHED", "dateUpdated": "2026-11-04T15:57:08.405Z", "dateReserved": "2026-10-07T12:39:11.178Z", "assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749", "datePublished": "2026-10-07T19:29:31.293Z", "assignerShortName": "redhat"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"collectionURL": "https://catalog.redhat.com/software/containers/", "cpes": ["cpe:/a:redhat:openshift:4.19::el9"], "defaultStatus": "affected", "packageName": "openshift4/ose-cluster-samples-rhel9-operator", "product": "Red Hat OpenShift Container Platform 4.19", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "1793123280", "versionType": "rpm"}]}, {"collectionURL": "https://catalog.redhat.com/software/containers/", "cpes": ["cpe:/a:redhat:openshift:4.20::el9"], "defaultStatus": "affected", "packageName": "openshift4/ose-cluster-samples-rhel9-operator", "product": "Red Hat OpenShift Container Platform 4.20", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "1792826398", "versionType": "rpm"}]}, {"collectionURL": "https://catalog.redhat.com/software/containers/", "cpes": ["cpe:/a:redhat:openshift:4.21::el9"], "defaultStatus": "affected", "packageName": "openshift4/ose-cluster-samples-rhel9-operator", "product": "Red Hat OpenShift Container Platform 4.21", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "1792852494", "versionType": "rpm"}]}, {"collectionURL": "https://catalog.redhat.com/software/containers/", "cpes": ["cpe:/a:redhat:openshift:4.22::el9"], "defaultStatus": "affected", "packageName": "openshift4/ose-cluster-samples-rhel9-operator", "product": "Red Hat OpenShift Container Platform 4.22", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "1792770602", "versionType": "rpm"}]}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:openshift:4"], "defaultStatus": "affected", "packageName": "openshift4/ose-cluster-samples-operator", "product": "Red Hat OpenShift Container Platform 4", "vendor": "Red Hat"}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:openshift:5"], "defaultStatus": "affected", "packageName": "openshift5/ose-cluster-samples-rhel9-operator", "product": "Red Hat OpenShift Container Platform 5", "vendor": "Red Hat"}], "source": "secalert@redhat.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "A flaw was found in the cluster-samples-operator. The RBAC Role coreos-pull-secret-reader in namespace openshift-config grants get, list, and watch permissions on all Secret resources without resourceNames scoping. The operator only requires access to the pull-secret Secret. If the samples-operator pod or its service account token is compromised through a separate vulnerability, an attacker could read all secrets in openshift-config, potentially including OAuth identity provider credentials, cloud provider credentials, and other sensitive cluster configuration."}], "id": "CVE-2026-107176", "lastModified": "2026-11-04T16:17:32.813", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "ADJACENT_NETWORK", "availabilityImpact": "NONE", "baseScore": 6.8, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 2.3, "impactScore": 4.0, "source": "secalert@redhat.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-107176", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-10-07T19:59:03.424144Z", "version": "2.0.3"}}]}, "published": "2026-10-07T20:17:11.153", "references": [{"source": "secalert@redhat.com", "url": "https://access.redhat.com/errata/RHSA-2026:89198"}, {"source": "secalert@redhat.com", "url": "https://access.redhat.com/errata/RHSA-2026:89341"}, {"source": "secalert@redhat.com", "url": "https://access.redhat.com/errata/RHSA-2026:89626"}, {"source": "secalert@redhat.com", "url": "https://access.redhat.com/errata/RHSA-2026:92280"}, {"source": "secalert@redhat.com", "url": "https://access.redhat.com/security/cve/CVE-2026-107176"}, {"source": "secalert@redhat.com", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2523035"}], "sourceIdentifier": "secalert@redhat.com", "vulnStatus": "Awaiting Analysis", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-250"}], "source": "secalert@redhat.com", "type": "Secondary"}]}

{"bugzilla": {"description": "cluster-samples-operator: Role reads ALL secrets in openshift-config, not just pull-secret", "id": "2523035", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2523035"}, "csaw": false, "cvss3": {"cvss3_base_score": "6.8", "cvss3_scoring_vector": "CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N", "status": "draft"}, "cwe": "CWE-250", "details": ["A flaw was found in the cluster-samples-operator. The RBAC Role coreos-pull-secret-reader in namespace openshift-config grants get, list, and watch permissions on all Secret resources without resourceNames scoping. The operator only requires access to the pull-secret Secret. If the samples-operator pod or its service account token is compromised through a separate vulnerability, an attacker could read all secrets in openshift-config, potentially including OAuth identity provider credentials, cloud provider credentials, and other sensitive cluster configuration."], "mitigation": {"lang": "en:us", "value": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."}, "name": "CVE-2026-107176", "package_state": [{"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Affected", "package_name": "openshift4/ose-cluster-samples-operator", "product_name": "Red Hat OpenShift Container Platform 4"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Affected", "package_name": "openshift4/ose-cluster-samples-rhel9-operator", "product_name": "Red Hat OpenShift Container Platform 4"}], "public_date": "2026-10-07T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-107176\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-107176"], "statement": "A flaw was found in the cluster-samples-operator where the RBAC Role `coreos-pull-secret-reader` (https://github.com/openshift/cluster-samples-operator/blob/release-5.1/manifests/05-kube-system-rbac.yaml#L1-L17) grants overly broad read access to secrets in the `openshift-config` namespace. The Role allows `get`, `list`, and `watch` on all `secrets` resources without a `resourceNames` restriction, although the operator only reads the single secret named `pull-secret` (https://github.com/openshift/cluster-samples-operator/blob/release-5.1/pkg/metrics/metrics.go#L182). Exploitation requires a prior compromise of the samples-operator pod or its service account token. Red Hat rates this as Moderate impact because the excessive RBAC permissions can only be leveraged after an attacker gains code execution within the operator pod or access to the service account token through a separate vulnerability.", "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": null}], "enrichment": {"confidence": 86.0, "confidence_source": "matching", "scores": [{"score": 90.0, "source": "inferred"}, {"score": 86.0, "source": "matching"}]}, "original": {"product": "Red Hat OpenShift Container Platform 4", "source": "cna", "vendor": "Red Hat"}, "product": "openshift_container_platform", "vendor": "redhat"}], "created": "2026-10-07T22:30:14.934974+00:00", "updated": "2026-10-09T07:30:17.930238+00:00", "vendors": ["redhat", "redhat$PRODUCT$openshift_container_platform"]}