CVE-2026-10840: Openshift-pipelines-operator-rh: openshift-pipelines-operator: tekton-scheduler-rolebinding grants system:authenticated write access to kueue and cert-manager resources

Synopsis

This is a privilege escalation vulnerability in the OpenShift Pipelines operator. The tekton-scheduler-rolebinding ClusterRoleBinding incorrectly grants write access to Kueue and cert-manager custom resources to every authenticated user on the cluster, reachable over the network with only a low-privilege account. Successful exploitation allows an attacker to disrupt workload scheduling, delete other tenants' Workload objects, or force cert-manager to overwrite TLS Secrets including the default ingress controller certificate. No fix versions have been published yet; HarborGuard is tracking the upstream advisory for patch availability.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The vulnerable API server endpoint is exposed over the network; an attacker must be able to reach the Kubernetes API server to send crafted requests.

• AuthenticationRequired

  Any low-privilege authenticated account is sufficient; the misconfigured ClusterRoleBinding applies to the entire system:authenticated group, so no elevated credentials are needed beyond a basic cluster login.

• Victim interactionNot required

  No victim action is needed; the attacker sends API requests directly without requiring any other user to click, approve, or otherwise interact.

• Attack complexityDetail

  Attack complexity is low, meaning the exploit is straightforward and requires no race conditions, special memory layout, or environmental prerequisites beyond cluster access.

Blast Radius

• Attacker deletes or modifies other tenants' Kueue Workload objects, disrupting job scheduling across the cluster.
• Attacker tampers with scheduling priorities, causing workloads to be starved or incorrectly prioritized.
• Attacker forces cert-manager to overwrite TLS Secrets, including the default ingress controller certificate, breaking HTTPS for cluster-wide ingress.
• Cluster availability is degraded as scheduling and certificate infrastructure are manipulated or destroyed.