CVE-2026-10840

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-10840", "assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749", "state": "PUBLISHED", "assignerShortName": "redhat", "dateReserved": "2026-06-04T11:29:18.169Z", "datePublished": "2026-06-04T12:04:42.823Z", "dateUpdated": "2026-09-07T12:05:07.518Z"}, "containers": {"cna": {"title": "Openshift-pipelines-operator-rh: openshift-pipelines-operator: tekton-scheduler-rolebinding grants system:authenticated write access to kueue and cert-manager resources", "metrics": [{"other": {"content": {"value": "Important", "namespace": "https://access.redhat.com/security/updates/classification/"}, "type": "Red Hat severity rating"}}, {"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.1, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H", "version": "3.1"}, "format": "CVSS"}], "descriptions": [{"lang": "en", "value": "A flaw was found in the OpenShift Pipelines operator. The tekton-scheduler-rolebinding ClusterRoleBinding grants the system:authenticated group write access to Kueue and cert-manager custom resources via the tekton-scheduler-role ClusterRole. When Kueue or cert-manager CRDs are present on the cluster, any authenticated user can disrupt workload scheduling, tamper with scheduling priorities, delete other tenants' Workload objects, or induce cert-manager to overwrite TLS Secrets including the default ingress controller certificate."}], "affected": [{"vendor": "Red Hat", "product": "Red Hat OpenShift Builds 1.7.3", "collectionURL": "https://catalog.redhat.com/software/containers/", "packageName": "openshift-builds/openshift-builds-rhel9-operator", "defaultStatus": "affected", "versions": [{"version": "1783341609", "lessThan": "*", "versionType": "rpm", "status": "unaffected"}], "cpes": ["cpe:/a:redhat:openshift_builds:1.7::el9"]}, {"vendor": "Red Hat", "product": "Red Hat OpenShift Builds 1.8.1", "collectionURL": "https://catalog.redhat.com/software/containers/", "packageName": "openshift-builds/openshift-builds-rhel9-operator", "defaultStatus": "affected", "versions": [{"version": "1784121108", "lessThan": "*", "versionType": "rpm", "status": "unaffected"}], "cpes": ["cpe:/a:redhat:openshift_builds:1.8::el9"]}, {"vendor": "Red Hat", "product": "OpenShift Pipelines", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "packageName": "openshift-pipelines/pipelines-operator-proxy-rhel8", "defaultStatus": "unaffected", "cpes": ["cpe:/a:redhat:openshift_pipelines:1"]}, {"vendor": "Red Hat", "product": "OpenShift Pipelines", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "packageName": "openshift-pipelines/pipelines-operator-proxy-rhel9", "defaultStatus": "affected", "cpes": ["cpe:/a:redhat:openshift_pipelines:1"]}, {"vendor": "Red Hat", "product": "OpenShift Pipelines", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "packageName": "openshift-pipelines/pipelines-operator-webhook-rhel8", "defaultStatus": "affected", "cpes": ["cpe:/a:redhat:openshift_pipelines:1"]}, {"vendor": "Red Hat", "product": "OpenShift Pipelines", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "packageName": "openshift-pipelines/pipelines-operator-webhook-rhel9", "defaultStatus": "affected", "cpes": ["cpe:/a:redhat:openshift_pipelines:1"]}, {"vendor": "Red Hat", "product": "OpenShift Pipelines", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "packageName": "openshift-pipelines/pipelines-rhel8-operator", "defaultStatus": "unaffected", "cpes": ["cpe:/a:redhat:openshift_pipelines:1"]}, {"vendor": "Red Hat", "product": "OpenShift Pipelines", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "packageName": "openshift-pipelines/pipelines-rhel9-operator", "defaultStatus": "affected", "cpes": ["cpe:/a:redhat:openshift_pipelines:1"]}], "references": [{"url": "https://access.redhat.com/errata/RHSA-2026:36648", "name": "RHSA-2026:36648", "tags": ["vendor-advisory", "x_refsource_REDHAT"]}, {"url": "https://access.redhat.com/errata/RHSA-2026:41036", "name": "RHSA-2026:41036", "tags": ["vendor-advisory", "x_refsource_REDHAT"]}, {"url": "https://access.redhat.com/security/cve/CVE-2026-10840", "tags": ["vdb-entry", "x_refsource_REDHAT"]}, {"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2484720", "name": "RHBZ#2484720", "tags": ["issue-tracking", "x_refsource_REDHAT"]}], "datePublic": "2026-04-25T00:00:00.000Z", "problemTypes": [{"descriptions": [{"cweId": "CWE-732", "description": "Incorrect Permission Assignment for Critical Resource", "lang": "en", "type": "CWE"}]}], "x_redhatCweChain": "CWE-732: Incorrect Permission Assignment for Critical Resource", "workarounds": [{"lang": "en", "value": "If the Tekton Scheduler feature is not in use, administrators can mitigate this by patching the ClusterRoleBinding to reference a specific ServiceAccount instead of system:authenticated:\n\noc patch clusterrolebinding tekton-scheduler-rolebinding --type=merge -p '{\"subjects\": [{\"kind\": \"ServiceAccount\", \"name\": \"openshift-pipelines-operator\", \"namespace\": \"openshift-operators\"}]}'\n\nIMPORTANT: The OpenShift Pipelines operator's reconciliation loop may revert this manual patch. Verify that the operator does not reconcile this binding back to system:authenticated after applying the mitigation. If it does, scale down the operator deployment or configure the operator to skip reconciliation of this object.\n\nAlternatively, the ClusterRoleBinding can be deleted if the Tekton Scheduler is not enabled."}], "timeline": [{"lang": "en", "time": "2026-04-25T00:00:00.000Z", "value": "Reported to Red Hat."}, {"lang": "en", "time": "2026-04-25T00:00:00.000Z", "value": "Made public."}], "credits": [{"lang": "en", "value": "Red Hat would like to thank Christopher Lusk (North Echo Security Research) for reporting this issue."}], "providerMetadata": {"orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749", "shortName": "redhat", "dateUpdated": "2026-09-06T01:39:09.770Z"}, "x_generator": {"engine": "cvelib 1.8.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-06-04T13:11:57.092142Z", "id": "CVE-2026-10840", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-06-04T15:06:49.750Z"}}, {"affected": [{"collectionURL": "https://catalog.redhat.com/software/containers/", "cpes": ["cpe:/a:redhat:openshift_builds:1.7::el9"], "defaultStatus": "affected", "packageName": "openshift-builds/openshift-builds-rhel9-operator", "product": "Red Hat OpenShift Builds 1.7.3", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "1783341609", "versionType": "rpm"}]}, {"collectionURL": "https://catalog.redhat.com/software/containers/", "cpes": ["cpe:/a:redhat:openshift_builds:1.8::el9"], "defaultStatus": "affected", "packageName": "openshift-builds/openshift-builds-rhel9-operator", "product": "Red Hat OpenShift Builds 1.8.1", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "1784121108", "versionType": "rpm"}]}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:openshift_pipelines:1"], "defaultStatus": "unaffected", "packageName": "openshift-pipelines/pipelines-operator-proxy-rhel8", "product": "OpenShift Pipelines", "vendor": "Red Hat"}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:openshift_pipelines:1"], "defaultStatus": "affected", "packageName": "openshift-pipelines/pipelines-operator-proxy-rhel9", "product": "OpenShift Pipelines", "vendor": "Red Hat"}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:openshift_pipelines:1"], "defaultStatus": "affected", "packageName": "openshift-pipelines/pipelines-operator-webhook-rhel8", "product": "OpenShift Pipelines", "vendor": "Red Hat"}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:openshift_pipelines:1"], "defaultStatus": "affected", "packageName": "openshift-pipelines/pipelines-operator-webhook-rhel9", "product": "OpenShift Pipelines", "vendor": "Red Hat"}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:openshift_pipelines:1"], "defaultStatus": "unaffected", "packageName": "openshift-pipelines/pipelines-rhel8-operator", "product": "OpenShift Pipelines", "vendor": "Red Hat"}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:openshift_pipelines:1"], "defaultStatus": "affected", "packageName": "openshift-pipelines/pipelines-rhel9-operator", "product": "OpenShift Pipelines", "vendor": "Red Hat"}], "datePublic": "2026-04-25T00:00:00.000Z", "descriptions": [{"lang": "en", "value": "A flaw was found in the OpenShift Pipelines operator. The tekton-scheduler-rolebinding ClusterRoleBinding grants the system:authenticated group write access to Kueue and cert-manager custom resources via the tekton-scheduler-role ClusterRole. When Kueue or cert-manager CRDs are present on the cluster, any authenticated user can disrupt workload scheduling, tamper with scheduling priorities, delete other tenants' Workload objects, or induce cert-manager to overwrite TLS Secrets including the default ingress controller certificate."}], "metrics": [{"other": {"content": {"namespace": "https://access.redhat.com/security/updates/classification/", "value": "Important"}, "type": "Red Hat severity rating"}}, {"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.1, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H", "version": "3.1"}, "format": "CVSS"}], "problemTypes": [{"descriptions": [{"cweId": "CWE-732", "description": "Incorrect Permission Assignment for Critical Resource", "lang": "en", "type": "CWE"}]}], "references": [{"tags": ["vdb-entry", "x_refsource_REDHAT"], "url": "https://access.redhat.com/security/cve/CVE-2026-10840"}, {"name": "RHBZ#2484720", "tags": ["issue-tracking", "x_refsource_REDHAT"], "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2484720"}, {"tags": ["x_sadp-csaf-vex"], "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-10840.json"}, {"tags": ["vendor-advisory", "x_refsource_REDHAT"], "url": "https://access.redhat.com/errata/RHSA-2026:36648"}, {"tags": ["vendor-advisory", "x_refsource_REDHAT"], "url": "https://access.redhat.com/errata/RHSA-2026:41036"}], "solutions": [{"lang": "en", "value": "RHSA-2026:36648: Red Hat OpenShift Builds 1.7.3"}, {"lang": "en", "value": "RHSA-2026:41036: Red Hat OpenShift Builds 1.8.1"}], "timeline": [{"lang": "en", "time": "2026-04-25T00:00:00.000Z", "value": "Reported to Red Hat."}, {"lang": "en", "time": "2026-04-25T00:00:00.000Z", "value": "Made public."}], "title": "openshift-pipelines-operator-rh: openshift-pipelines-operator: tekton-scheduler-rolebinding grants system:authenticated write access to Kueue and cert-manager resources", "workarounds": [{"lang": "en", "value": "If the Tekton Scheduler feature is not in use, administrators can mitigate this by patching the ClusterRoleBinding to reference a specific ServiceAccount instead of system:authenticated:\n\noc patch clusterrolebinding tekton-scheduler-rolebinding --type=merge -p '{\"subjects\": [{\"kind\": \"ServiceAccount\", \"name\": \"openshift-pipelines-operator\", \"namespace\": \"openshift-operators\"}]}'\n\nIMPORTANT: The OpenShift Pipelines operator's reconciliation loop may revert this manual patch. Verify that the operator does not reconcile this binding back to system:authenticated after applying the mitigation. If it does, scale down the operator deployment or configure the operator to skip reconciliation of this object.\n\nAlternatively, the ClusterRoleBinding can be deleted if the Tekton Scheduler is not enabled."}], "x_adpType": "supplier", "x_generator": {"engine": "sadp-cli 1.0.0"}, "providerMetadata": {"orgId": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c", "shortName": "redhat-SADP", "dateUpdated": "2026-09-07T12:05:07.518Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "openshift-pipelines-operator-rh: openshift-pipelines-operator: tekton-scheduler-rolebinding grants system:authenticated write access to Kueue and cert-manager resources", "metrics": [{"other": {"type": "Red Hat severity rating", "content": {"value": "Important", "namespace": "https://access.redhat.com/security/updates/classification/"}}}, {"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.1, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "NONE"}}], "affected": [{"cpes": ["cpe:/a:redhat:openshift_builds:1.7::el9"], "vendor": "Red Hat", "product": "Red Hat OpenShift Builds 1.7.3", "versions": [{"status": "unaffected", "version": "1783341609", "lessThan": "*", "versionType": "rpm"}], "packageName": "openshift-builds/openshift-builds-rhel9-operator", "collectionURL": "https://catalog.redhat.com/software/containers/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:openshift_builds:1.8::el9"], "vendor": "Red Hat", "product": "Red Hat OpenShift Builds 1.8.1", "versions": [{"status": "unaffected", "version": "1784121108", "lessThan": "*", "versionType": "rpm"}], "packageName": "openshift-builds/openshift-builds-rhel9-operator", "collectionURL": "https://catalog.redhat.com/software/containers/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:openshift_pipelines:1"], "vendor": "Red Hat", "product": "OpenShift Pipelines", "packageName": "openshift-pipelines/pipelines-operator-proxy-rhel8", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "unaffected"}, {"cpes": ["cpe:/a:redhat:openshift_pipelines:1"], "vendor": "Red Hat", "product": "OpenShift Pipelines", "packageName": "openshift-pipelines/pipelines-operator-proxy-rhel9", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:openshift_pipelines:1"], "vendor": "Red Hat", "product": "OpenShift Pipelines", "packageName": "openshift-pipelines/pipelines-operator-webhook-rhel8", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:openshift_pipelines:1"], "vendor": "Red Hat", "product": "OpenShift Pipelines", "packageName": "openshift-pipelines/pipelines-operator-webhook-rhel9", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:openshift_pipelines:1"], "vendor": "Red Hat", "product": "OpenShift Pipelines", "packageName": "openshift-pipelines/pipelines-rhel8-operator", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "unaffected"}, {"cpes": ["cpe:/a:redhat:openshift_pipelines:1"], "vendor": "Red Hat", "product": "OpenShift Pipelines", "packageName": "openshift-pipelines/pipelines-rhel9-operator", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected"}], "timeline": [{"lang": "en", "time": "2026-04-25T00:00:00.000Z", "value": "Reported to Red Hat."}, {"lang": "en", "time": "2026-04-25T00:00:00.000Z", "value": "Made public."}], "solutions": [{"lang": "en", "value": "RHSA-2026:36648: Red Hat OpenShift Builds 1.7.3"}, {"lang": "en", "value": "RHSA-2026:41036: Red Hat OpenShift Builds 1.8.1"}], "x_adpType": "supplier", "datePublic": "2026-04-25T00:00:00.000Z", "references": [{"url": "https://access.redhat.com/security/cve/CVE-2026-10840", "tags": ["vdb-entry", "x_refsource_REDHAT"]}, {"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2484720", "name": "RHBZ#2484720", "tags": ["issue-tracking", "x_refsource_REDHAT"]}, {"url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-10840.json", "tags": ["x_sadp-csaf-vex"]}, {"url": "https://access.redhat.com/errata/RHSA-2026:36648", "tags": ["vendor-advisory", "x_refsource_REDHAT"]}, {"url": "https://access.redhat.com/errata/RHSA-2026:41036", "tags": ["vendor-advisory", "x_refsource_REDHAT"]}], "workarounds": [{"lang": "en", "value": "If the Tekton Scheduler feature is not in use, administrators can mitigate this by patching the ClusterRoleBinding to reference a specific ServiceAccount instead of system:authenticated:\n\noc patch clusterrolebinding tekton-scheduler-rolebinding --type=merge -p '{\"subjects\": [{\"kind\": \"ServiceAccount\", \"name\": \"openshift-pipelines-operator\", \"namespace\": \"openshift-operators\"}]}'\n\nIMPORTANT: The OpenShift Pipelines operator's reconciliation loop may revert this manual patch. Verify that the operator does not reconcile this binding back to system:authenticated after applying the mitigation. If it does, scale down the operator deployment or configure the operator to skip reconciliation of this object.\n\nAlternatively, the ClusterRoleBinding can be deleted if the Tekton Scheduler is not enabled."}], "x_generator": {"engine": "sadp-cli 1.0.0"}, "descriptions": [{"lang": "en", "value": "A flaw was found in the OpenShift Pipelines operator. The tekton-scheduler-rolebinding ClusterRoleBinding grants the system:authenticated group write access to Kueue and cert-manager custom resources via the tekton-scheduler-role ClusterRole. When Kueue or cert-manager CRDs are present on the cluster, any authenticated user can disrupt workload scheduling, tamper with scheduling priorities, delete other tenants' Workload objects, or induce cert-manager to overwrite TLS Secrets including the default ingress controller certificate."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-732", "description": "Incorrect Permission Assignment for Critical Resource"}]}], "providerMetadata": {"orgId": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c", "shortName": "redhat-SADP", "dateUpdated": "2026-09-07T12:05:07.518Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-10840", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-06-04T13:11:57.092142Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-06-04T13:12:02.813Z"}}], "cna": {"title": "Openshift-pipelines-operator-rh: openshift-pipelines-operator: tekton-scheduler-rolebinding grants system:authenticated write access to kueue and cert-manager resources", "credits": [{"lang": "en", "value": "Red Hat would like to thank Christopher Lusk (North Echo Security Research) for reporting this issue."}], "metrics": [{"other": {"type": "Red Hat severity rating", "content": {"value": "Important", "namespace": "https://access.redhat.com/security/updates/classification/"}}}, {"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.1, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "NONE"}}], "affected": [{"cpes": ["cpe:/a:redhat:openshift_builds:1.7::el9"], "vendor": "Red Hat", "product": "Red Hat OpenShift Builds 1.7.3", "versions": [{"status": "unaffected", "version": "1783341609", "lessThan": "*", "versionType": "rpm"}], "packageName": "openshift-builds/openshift-builds-rhel9-operator", "collectionURL": "https://catalog.redhat.com/software/containers/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:openshift_builds:1.8::el9"], "vendor": "Red Hat", "product": "Red Hat OpenShift Builds 1.8.1", "versions": [{"status": "unaffected", "version": "1784121108", "lessThan": "*", "versionType": "rpm"}], "packageName": "openshift-builds/openshift-builds-rhel9-operator", "collectionURL": "https://catalog.redhat.com/software/containers/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:openshift_pipelines:1"], "vendor": "Red Hat", "product": "OpenShift Pipelines", "packageName": "openshift-pipelines/pipelines-operator-proxy-rhel8", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "unaffected"}, {"cpes": ["cpe:/a:redhat:openshift_pipelines:1"], "vendor": "Red Hat", "product": "OpenShift Pipelines", "packageName": "openshift-pipelines/pipelines-operator-proxy-rhel9", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:openshift_pipelines:1"], "vendor": "Red Hat", "product": "OpenShift Pipelines", "packageName": "openshift-pipelines/pipelines-operator-webhook-rhel8", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:openshift_pipelines:1"], "vendor": "Red Hat", "product": "OpenShift Pipelines", "packageName": "openshift-pipelines/pipelines-operator-webhook-rhel9", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:openshift_pipelines:1"], "vendor": "Red Hat", "product": "OpenShift Pipelines", "packageName": "openshift-pipelines/pipelines-rhel8-operator", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "unaffected"}, {"cpes": ["cpe:/a:redhat:openshift_pipelines:1"], "vendor": "Red Hat", "product": "OpenShift Pipelines", "packageName": "openshift-pipelines/pipelines-rhel9-operator", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected"}], "timeline": [{"lang": "en", "time": "2026-04-25T00:00:00.000Z", "value": "Reported to Red Hat."}, {"lang": "en", "time": "2026-04-25T00:00:00.000Z", "value": "Made public."}], "datePublic": "2026-04-25T00:00:00.000Z", "references": [{"url": "https://access.redhat.com/errata/RHSA-2026:36648", "name": "RHSA-2026:36648", "tags": ["vendor-advisory", "x_refsource_REDHAT"]}, {"url": "https://access.redhat.com/errata/RHSA-2026:41036", "name": "RHSA-2026:41036", "tags": ["vendor-advisory", "x_refsource_REDHAT"]}, {"url": "https://access.redhat.com/security/cve/CVE-2026-10840", "tags": ["vdb-entry", "x_refsource_REDHAT"]}, {"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2484720", "name": "RHBZ#2484720", "tags": ["issue-tracking", "x_refsource_REDHAT"]}], "workarounds": [{"lang": "en", "value": "If the Tekton Scheduler feature is not in use, administrators can mitigate this by patching the ClusterRoleBinding to reference a specific ServiceAccount instead of system:authenticated:\n\noc patch clusterrolebinding tekton-scheduler-rolebinding --type=merge -p '{\"subjects\": [{\"kind\": \"ServiceAccount\", \"name\": \"openshift-pipelines-operator\", \"namespace\": \"openshift-operators\"}]}'\n\nIMPORTANT: The OpenShift Pipelines operator's reconciliation loop may revert this manual patch. Verify that the operator does not reconcile this binding back to system:authenticated after applying the mitigation. If it does, scale down the operator deployment or configure the operator to skip reconciliation of this object.\n\nAlternatively, the ClusterRoleBinding can be deleted if the Tekton Scheduler is not enabled."}], "x_generator": {"engine": "cvelib 1.8.0"}, "descriptions": [{"lang": "en", "value": "A flaw was found in the OpenShift Pipelines operator. The tekton-scheduler-rolebinding ClusterRoleBinding grants the system:authenticated group write access to Kueue and cert-manager custom resources via the tekton-scheduler-role ClusterRole. When Kueue or cert-manager CRDs are present on the cluster, any authenticated user can disrupt workload scheduling, tamper with scheduling priorities, delete other tenants' Workload objects, or induce cert-manager to overwrite TLS Secrets including the default ingress controller certificate."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-732", "description": "Incorrect Permission Assignment for Critical Resource"}]}], "providerMetadata": {"orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749", "shortName": "redhat", "dateUpdated": "2026-09-06T01:39:09.770Z"}, "x_redhatCweChain": "CWE-732: Incorrect Permission Assignment for Critical Resource"}}, "cveMetadata": {"cveId": "CVE-2026-10840", "state": "PUBLISHED", "dateUpdated": "2026-09-07T12:05:07.518Z", "dateReserved": "2026-06-04T11:29:18.169Z", "assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749", "datePublished": "2026-06-04T12:04:42.823Z", "assignerShortName": "redhat"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"collectionURL": "https://catalog.redhat.com/software/containers/", "cpes": ["cpe:/a:redhat:openshift_builds:1.7::el9"], "defaultStatus": "affected", "packageName": "openshift-builds/openshift-builds-rhel9-operator", "product": "Red Hat OpenShift Builds 1.7.3", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "1783341609", "versionType": "rpm"}]}, {"collectionURL": "https://catalog.redhat.com/software/containers/", "cpes": ["cpe:/a:redhat:openshift_builds:1.8::el9"], "defaultStatus": "affected", "packageName": "openshift-builds/openshift-builds-rhel9-operator", "product": "Red Hat OpenShift Builds 1.8.1", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "1784121108", "versionType": "rpm"}]}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:openshift_pipelines:1"], "defaultStatus": "unaffected", "packageName": "openshift-pipelines/pipelines-operator-proxy-rhel8", "product": "OpenShift Pipelines", "vendor": "Red Hat"}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:openshift_pipelines:1"], "defaultStatus": "affected", "packageName": "openshift-pipelines/pipelines-operator-proxy-rhel9", "product": "OpenShift Pipelines", "vendor": "Red Hat"}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:openshift_pipelines:1"], "defaultStatus": "affected", "packageName": "openshift-pipelines/pipelines-operator-webhook-rhel8", "product": "OpenShift Pipelines", "vendor": "Red Hat"}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:openshift_pipelines:1"], "defaultStatus": "affected", "packageName": "openshift-pipelines/pipelines-operator-webhook-rhel9", "product": "OpenShift Pipelines", "vendor": "Red Hat"}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:openshift_pipelines:1"], "defaultStatus": "unaffected", "packageName": "openshift-pipelines/pipelines-rhel8-operator", "product": "OpenShift Pipelines", "vendor": "Red Hat"}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:openshift_pipelines:1"], "defaultStatus": "affected", "packageName": "openshift-pipelines/pipelines-rhel9-operator", "product": "OpenShift Pipelines", "vendor": "Red Hat"}], "source": "secalert@redhat.com"}, {"affectedData": [{"collectionURL": "https://catalog.redhat.com/software/containers/", "cpes": ["cpe:/a:redhat:openshift_builds:1.7::el9"], "defaultStatus": "affected", "packageName": "openshift-builds/openshift-builds-rhel9-operator", "product": "Red Hat OpenShift Builds 1.7.3", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "1783341609", "versionType": "rpm"}]}, {"collectionURL": "https://catalog.redhat.com/software/containers/", "cpes": ["cpe:/a:redhat:openshift_builds:1.8::el9"], "defaultStatus": "affected", "packageName": "openshift-builds/openshift-builds-rhel9-operator", "product": "Red Hat OpenShift Builds 1.8.1", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "1784121108", "versionType": "rpm"}]}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:openshift_pipelines:1"], "defaultStatus": "unaffected", "packageName": "openshift-pipelines/pipelines-operator-proxy-rhel8", "product": "OpenShift Pipelines", "vendor": "Red Hat"}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:openshift_pipelines:1"], "defaultStatus": "affected", "packageName": "openshift-pipelines/pipelines-operator-proxy-rhel9", "product": "OpenShift Pipelines", "vendor": "Red Hat"}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:openshift_pipelines:1"], "defaultStatus": "affected", "packageName": "openshift-pipelines/pipelines-operator-webhook-rhel8", "product": "OpenShift Pipelines", "vendor": "Red Hat"}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:openshift_pipelines:1"], "defaultStatus": "affected", "packageName": "openshift-pipelines/pipelines-operator-webhook-rhel9", "product": "OpenShift Pipelines", "vendor": "Red Hat"}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:openshift_pipelines:1"], "defaultStatus": "unaffected", "packageName": "openshift-pipelines/pipelines-rhel8-operator", "product": "OpenShift Pipelines", "vendor": "Red Hat"}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:openshift_pipelines:1"], "defaultStatus": "affected", "packageName": "openshift-pipelines/pipelines-rhel9-operator", "product": "OpenShift Pipelines", "vendor": "Red Hat"}], "source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "A flaw was found in the OpenShift Pipelines operator. The tekton-scheduler-rolebinding ClusterRoleBinding grants the system:authenticated group write access to Kueue and cert-manager custom resources via the tekton-scheduler-role ClusterRole. When Kueue or cert-manager CRDs are present on the cluster, any authenticated user can disrupt workload scheduling, tamper with scheduling priorities, delete other tenants' Workload objects, or induce cert-manager to overwrite TLS Secrets including the default ingress controller certificate."}, {"lang": "es", "value": "Una falla se encontr\u00f3 en el operador de OpenShift Pipelines. El ClusterRoleBinding tekton-scheduler-rolebinding otorga al grupo system:authenticated acceso de escritura a los recursos personalizados de Kueue y cert-manager a trav\u00e9s del ClusterRole tekton-scheduler-role. Cuando los CRD de Kueue o cert-manager est\u00e1n presentes en el cl\u00faster, cualquier usuario autenticado puede interrumpir la programaci\u00f3n de cargas de trabajo, manipular las prioridades de programaci\u00f3n, eliminar objetos Workload de otros inquilinos o inducir a cert-manager a sobrescribir Secretos TLS, incluyendo el certificado predeterminado del controlador de entrada."}], "id": "CVE-2026-10840", "lastModified": "2026-09-06T02:17:18.100", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.1, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 4.2, "source": "secalert@redhat.com", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.1, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 4.2, "source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-10840", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-06-04T13:11:57.092142Z", "version": "2.0.3"}}]}, "published": "2026-06-04T12:16:24.813", "references": [{"source": "secalert@redhat.com", "url": "https://access.redhat.com/errata/RHSA-2026:36648"}, {"source": "secalert@redhat.com", "url": "https://access.redhat.com/errata/RHSA-2026:41036"}, {"source": "secalert@redhat.com", "url": "https://access.redhat.com/security/cve/CVE-2026-10840"}, {"source": "secalert@redhat.com", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2484720"}, {"source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c", "url": "https://access.redhat.com/errata/RHSA-2026:36648"}, {"source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c", "url": "https://access.redhat.com/errata/RHSA-2026:41036"}, {"source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c", "url": "https://access.redhat.com/security/cve/CVE-2026-10840"}, {"source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2484720"}, {"source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c", "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-10840.json"}], "sourceIdentifier": "secalert@redhat.com", "vulnStatus": "Awaiting Analysis", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-732"}], "source": "secalert@redhat.com", "type": "Secondary"}, {"description": [{"lang": "en", "value": "CWE-732"}], "source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": null}], "enrichment": {"confidence": 100.0, "confidence_source": "manual", "scores": [{"score": 100.0, "source": "manual"}]}, "original": {"product": "Builds for Red Hat OpenShift", "source": "cna", "vendor": "Red Hat"}, "product": "openshift", "vendor": "redhat"}, {"configurations": [{"platform": null, "status": "affected", "versions": null}], "enrichment": {"confidence": 98.0, "confidence_source": "matching", "scores": [{"score": 98.0, "source": "matching"}]}, "original": {"product": "OpenShift Pipelines", "source": "cna", "vendor": "Red Hat"}, "product": "openshift_pipelines", "vendor": "redhat"}], "created": "2026-06-04T13:30:06.491543+00:00", "updated": "2026-06-09T10:00:07.158148+00:00", "vendors": ["redhat", "redhat$PRODUCT$openshift", "redhat$PRODUCT$openshift_pipelines"]}