CVE-2026-107176: Cluster-samples-operator: role reads all secrets in openshift-config, not just pull-secret

Severity: medium (CVSS 6.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.2% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-10-07 · updated 2026-10-30
Weakness: CWE-250

Description

A flaw was found in the cluster-samples-operator. The RBAC Role coreos-pull-secret-reader in namespace openshift-config grants get, list, and watch permissions on all Secret resources without resourceNames scoping. The operator only requires access to the pull-secret Secret. If the samples-operator pod or its service account token is compromised through a separate vulnerability, an attacker could read all secrets in openshift-config, potentially including OAuth identity provider credentials, cloud provider credentials, and other sensitive cluster configuration.

Affected products

Red Hat OpenShift Container Platform 4.18: all versions
Red Hat OpenShift Container Platform 4.20: all versions — fixed in 1792826398
Red Hat OpenShift Container Platform 4.21: all versions — fixed in 1792852494
Red Hat OpenShift Container Platform 4.22: all versions — fixed in 1792770602
Red Hat OpenShift Container Platform 5: all versions

How to fix

Upgrade to a fixed version: Red Hat OpenShift Container Platform 4.20 1792826398; Red Hat OpenShift Container Platform 4.21 1792852494; Red Hat OpenShift Container Platform 4.22 1792770602. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2026-107176 or the next vulnerability affects your stack