CVE-2026-10843: Cloud-credential-operator: cco mint-mode credentialsrequest manifests grant account-wide iam access beyond cluster scope on aws

Synopsis

A privilege-scope misconfiguration in the OpenShift Cloud Credential Operator (CCO) causes Mint-mode IAM credentials on AWS to be provisioned with account-wide permissions for destructive actions, rather than being scoped to cluster-owned resources. The flaw is reachable over the network by an admin-level user, meaning an attacker who compromises a privileged OpenShift credential can then use those over-provisioned IAM policies to affect the entire AWS account, not just the cluster. Successful exploitation enables an attacker to read, modify, or destroy AWS resources outside the cluster boundary. HarborGuard is tracking this advisory and will make a patched-image rebuild available the moment an upstream fix is published.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The vulnerable component is exposed over the network, so an attacker must be able to reach the OpenShift API or CCO endpoint across a network path.

• AuthenticationRequired

  Exploitation requires an admin or otherwise privileged account; a low-privilege credential is not sufficient to trigger the affected IAM provisioning path.

• Victim interactionNot required

  No user interaction is needed; the attacker can act entirely without involving another user or operator.

• Attack complexityDetail

  Attack complexity is low, meaning the exploit is reliable and does not depend on race conditions, specific memory layout, or other environmental factors.

Blast Radius

• An attacker who compromises a privileged credential gains access to IAM permissions scoped to the entire AWS account, not just cluster-owned resources.
• The attacker can read AWS resources across the account, including storage buckets, secrets, and other services that the cluster should not have visibility into.
• The attacker can modify or delete AWS infrastructure outside the cluster, such as altering IAM policies, removing storage objects, or reconfiguring networking resources account-wide.
• The attacker can trigger service disruptions that extend beyond the OpenShift cluster itself, affecting any AWS workload sharing the same account.