THREATOPS

THREAT OPS › Threat News › [NVD] CVE-2026-10840 (HIGH 7.1) — A flaw was found in the OpenShift Pipelines operator. The tekton-scheduler-rolebinding ClusterRoleBinding grants the system:authenticated group write access to Kueue and cert-manager custom resources via the tekton-scheduler-role ClusterRole. When Kueue or cert-manager CRDs are p

[NVD] CVE-2026-10840 (HIGH 7.1) — A flaw was found in the OpenShift Pipelines operator. The tekton-scheduler-rolebinding ClusterRoleBinding grants the system:authenticated group write access to Kueue and cert-manager custom resources via the tekton-scheduler-role ClusterRole. When Kueue or cert-manager CRDs are p

lownvdPublished 2026-06-04

CVE-2026-10840 CVSS: 7.1 HIGH Published: 2026-06-04T12:16:24.813

A flaw was found in the OpenShift Pipelines operator. The tekton-scheduler-rolebinding ClusterRoleBinding grants the system:authenticated group write access to Kueue and cert-manager custom resources via the tekton-scheduler-role ClusterRole. When Kueue or cert-manager CRDs are present on the cluster, any authenticated user can disr

Indicators of compromise

CVE-2026-10840cve

Original source: https://nvd.nist.gov/vuln/detail/CVE-2026-10840