CVE-2026-10840

Name of the Vulnerable Software and Affected Versions OpenShift Pipelines operator (affected versions not specified)

Description A flaw in the OpenShift Pipelines operator occurs because the tekton-scheduler-rolebinding ClusterRoleBinding grants the system:authenticated group write access to Kueue and cert-manager custom resources through the tekton-scheduler-role ClusterRole. If Kueue or cert-manager Custom Resource Definitions (CRDs) are present on the cluster, any authenticated user can disrupt workload scheduling, tamper with scheduling priorities, delete Workload objects belonging to other tenants, or cause cert-manager to overwrite TLS Secrets, including the default ingress controller certificate.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.