VDB

CVE-2026-10840

CVE-2026-10840 PUBLISHED CVSS 7.1 HIGH

Reported by redhat · Published June 4, 2026

A flaw was found in the OpenShift Pipelines operator. The tekton-scheduler-rolebinding ClusterRoleBinding grants the system:authenticated group write access to Kueue and cert-manager custom resources via the tekton-scheduler-role ClusterRole. When Kueue or cert-manager CRDs are present on the cluster, any authenticated user can disrupt workload scheduling, tamper with scheduling priorities, delete other tenants' Workload objects, or induce cert-manager to overwrite TLS Secrets including the default ingress controller certificate.

Risk Scores

CVSS 3.1
7.1
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H

Affected Products

VendorProductVersions
Red HatRed Hat OpenShift Builds 1.7.31783341609
Red HatRed Hat OpenShift Builds 1.8.11784121108
Red HatOpenShift Pipelines
Red HatOpenShift Pipelines
Red HatOpenShift Pipelines
Red HatOpenShift Pipelines
Red HatOpenShift Pipelines
Red HatOpenShift Pipelines
Red HatRed Hat OpenShift Builds 1.7.21783341609, 1783341609
Red HatBuilds for Red Hat OpenShift
Red HatRed Hat OpenShift Builds 1.7.31783341609, 1783341609, 1783341609
Red HatOpenShift Pipelines
Red HatOpenShift Pipelines
Red HatRed Hat OpenShift Builds 1.7.41783341609, 1783341609, 1783341609
Red HatRed Hat OpenShift Builds 1.7.31783341609, 1783341609, 1783341609
Red HatRed Hat OpenShift Builds 1.7.4
Red HatOpenShift Pipelines
Red HatRed Hat OpenShift Builds 1.7.11783341609, 1783341609
Red HatBuilds for Red Hat OpenShift
Red HatOpenShift Pipelines

…and 15 more

Timeline

  • Jun 4, 2026 CVE Published
  • Jun 5, 2026 EPSS Score
  • Jun 11, 2026 Coalition ESS Score
  • Aug 7, 2026 EPSS Score
  • Aug 18, 2026 Distribution Patch
  • Aug 18, 2026 Distribution Patch
  • Aug 18, 2026 Security Advisory
  • Aug 18, 2026 Security Advisory
  • Aug 24, 2026 EPSS Score
  • Sep 5, 2026 EPSS Score
  • Sep 6, 2026 CVE Updated
  • Sep 12, 2026 EPSS Score

References

Open in Interactive Console →
$ Console Community · 50/day Open console ›