6.8Mittel
CVE-2026-107176Cluster-samples-operator: role reads all secrets in openshift-config, not just pull-secret
Beschreibung
A flaw was found in the cluster-samples-operator. The RBAC Role coreos-pull-secret-reader in namespace openshift-config grants get, list, and watch permissions on all Secret resources without resourceNames scoping. The operator only requires access to the pull-secret Secret. If the samples-operator pod or its service account token is compromised through a separate vulnerability, an attacker could read all secrets in openshift-config, potentially including OAuth identity provider credentials, cloud provider credentials, and other sensitive cluster configuration.
Schwachstellentyp (CWE):
CWE-250
Daten: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Wiedergegeben wie in der Quelle, auf Englisch.
Betroffene Produkte und Versionen
| Hersteller | Produkt | Versionen | |
|---|---|---|---|
| openshift | 4.19 | — | |
| openshift | 4.20 | — | |
| openshift | 4.21 | — | |
| openshift | 4.22 | — | |
| Red Hat | Red Hat OpenShift Container Platform 4 | all versions | |
| Red Hat | Red Hat OpenShift Container Platform 4.19 | all versions | |
| Red Hat | Red Hat OpenShift Container Platform 4.20 | all versions | |
| Red Hat | Red Hat OpenShift Container Platform 4.21 | all versions | |
| Red Hat | Red Hat OpenShift Container Platform 4.22 | all versions | |
| Red Hat | Red Hat OpenShift Container Platform 5 | all versions |
Referenzen und Patches
- RHSA-2026:89198 vendor-advisory
- RHSA-2026:89341 vendor-advisory
- RHSA-2026:89626 vendor-advisory
- RHSA-2026:92280 vendor-advisory
- https://access.redhat.com/security/cve/CVE-2026-107176 vdb-entry
- RHBZ#2523035 issue-tracking