https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-06T05:45:34.906144+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/cve-2026-10840 CVE-2026-10840 — Openshift-pipelines-operator-rh: openshift-pipelines-operator: tekton-scheduler-rolebinding grants system:authenticated… 2026-10-06T05:45:35.001949+00:00

Affected: Red Hat OpenShift Builds 1.7.3, Red Hat OpenShift Builds 1.8.1, Red Hat OpenShift Pipelines

A flaw was found in the OpenShift Pipelines operator. The tekton-scheduler-rolebinding ClusterRoleBinding grants the system:authenticated group write access to Kueue and cert-manager custom resources via the tekton-scheduler-role ClusterRole. When Kueue or cert-manager CRDs are present on the cluster, any authenticated user can disrupt workload scheduling, tamper with scheduling priorities, delete other tenants' Workload objects, or induce cert-manager to overwrite TLS Secrets including the default ingress controller certificate.