What’s Vulnerable › Vulnerabilities

CVE-2026-10840: Openshift-pipelines-operator-rh: openshift-pipelines-operator: tekton-scheduler-rolebinding grants system:authenticated write access to kueue and cert-manager resources

• Severity: high (CVSS 7.1 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.2% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-06-04 · updated 2026-09-06
• Weakness: CWE-732

Description

A flaw was found in the OpenShift Pipelines operator. The tekton-scheduler-rolebinding ClusterRoleBinding grants the system:authenticated group write access to Kueue and cert-manager custom resources via the tekton-scheduler-role ClusterRole. When Kueue or cert-manager CRDs are present on the cluster, any authenticated user can disrupt workload scheduling, tamper with scheduling priorities, delete other tenants' Workload objects, or induce cert-manager to overwrite TLS Secrets including the default ingress controller certificate.

Affected products

• Red Hat OpenShift Pipelines: all versions
• Red Hat OpenShift Builds 1.7.3: all versions — fixed in 1783341609
• Red Hat OpenShift Builds 1.8.1: all versions — fixed in 1784121108

How to fix

Upgrade to a fixed version: Red Hat OpenShift Builds 1.7.3 1783341609; Red Hat OpenShift Builds 1.8.1 1784121108. Check the vendor advisory for mitigations.

References

• https://access.redhat.com/errata/RHSA-2026:36648
• https://access.redhat.com/errata/RHSA-2026:41036
• https://access.redhat.com/security/cve/CVE-2026-10840
• https://bugzilla.redhat.com/show_bug.cgi?id=2484720
• https://access.redhat.com/errata/RHSA-2026:36648
• https://access.redhat.com/errata/RHSA-2026:41036
• https://access.redhat.com/security/cve/CVE-2026-10840
• https://bugzilla.redhat.com/show_bug.cgi?id=2484720
• https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-10840.json

Get alerted when CVE-2026-10840 or the next vulnerability affects your stack