Описание
A flaw was found in the OpenShift Pipelines operator. The tekton-scheduler-rolebinding ClusterRoleBinding grants the system:authenticated group write access to Kueue and cert-manager custom resources via the tekton-scheduler-role ClusterRole. When Kueue or cert-manager CRDs are present on the cluster, any authenticated user can disrupt workload scheduling, tamper with scheduling priorities, delete other tenants' Workload objects, or induce cert-manager to overwrite TLS Secrets including the default ingress controller certificate.
Отчет
This is an Important flaw in the OpenShift Pipelines operator where the tekton-scheduler-rolebinding grants system:authenticated users cluster-wide write access to Kueue and cert-manager resources. This allows any authenticated user to disrupt workload scheduling, manipulate priorities, delete Workload objects, or may overwrite TLS Secrets, such as the default ingress controller certificate, by leveraging cert-manager's privileges. The vulnerable RBAC objects are deployed regardless of whether the Tekton Scheduler feature is enabled.
Меры по смягчению последствий
If the Tekton Scheduler feature is not in use, administrators can mitigate this by patching the ClusterRoleBinding to reference a specific ServiceAccount instead of system:authenticated: oc patch clusterrolebinding tekton-scheduler-rolebinding --type=merge -p '{"subjects": [{"kind": "ServiceAccount", "name": "openshift-pipelines-operator", "namespace": "openshift-operators"}]}' IMPORTANT: The OpenShift Pipelines operator's reconciliation loop may revert this manual patch. Verify that the operator does not reconcile this binding back to system:authenticated after applying the mitigation. If it does, scale down the operator deployment or configure the operator to skip reconciliation of this object. Alternatively, the ClusterRoleBinding can be deleted if the Tekton Scheduler is not enabled.
Затронутые пакеты
| Платформа | Пакет | Состояние | Рекомендация | Релиз |
|---|---|---|---|---|
| OpenShift Pipelines | openshift-pipelines/pipelines-operator-proxy-rhel8 | Not affected | ||
| OpenShift Pipelines | openshift-pipelines/pipelines-operator-proxy-rhel9 | Affected | ||
| OpenShift Pipelines | openshift-pipelines/pipelines-operator-webhook-rhel8 | Affected | ||
| OpenShift Pipelines | openshift-pipelines/pipelines-operator-webhook-rhel9 | Affected | ||
| OpenShift Pipelines | openshift-pipelines/pipelines-rhel8-operator | Not affected | ||
| OpenShift Pipelines | openshift-pipelines/pipelines-rhel9-operator | Affected | ||
| Red Hat OpenShift Builds 1.7.3 | openshift-builds/openshift-builds-rhel9-operator | Fixed | RHSA-2026:36648 | 08.07.2026 |
| Red Hat OpenShift Builds 1.8.1 | openshift-builds/openshift-builds-rhel9-operator | Fixed | RHSA-2026:41036 | 16.07.2026 |
Показывать по
Дополнительная информация
Статус:
EPSS
7.1 High
CVSS3
Связанные уязвимости
A flaw was found in the OpenShift Pipelines operator. The tekton-scheduler-rolebinding ClusterRoleBinding grants the system:authenticated group write access to Kueue and cert-manager custom resources via the tekton-scheduler-role ClusterRole. When Kueue or cert-manager CRDs are present on the cluster, any authenticated user can disrupt workload scheduling, tamper with scheduling priorities, delete other tenants' Workload objects, or induce cert-manager to overwrite TLS Secrets including the default ingress controller certificate.
A flaw was found in the OpenShift Pipelines operator. The tekton-scheduler-rolebinding ClusterRoleBinding grants the system:authenticated group write access to Kueue and cert-manager custom resources via the tekton-scheduler-role ClusterRole. When Kueue or cert-manager CRDs are present on the cluster, any authenticated user can disrupt workload scheduling, tamper with scheduling priorities, delete other tenants' Workload objects, or induce cert-manager to overwrite TLS Secrets including the default ingress controller certificate.
EPSS
7.1 High
CVSS3