CVE-2026-10840

Openshift-pipelines-operator-rh: openshift-pipelines-operator: tekton-scheduler-rolebinding grants system:authenticated write access to kueue and cert-manager resources

7.1 High

A flaw was found in the OpenShift Pipelines operator. The tekton-scheduler-rolebinding ClusterRoleBinding grants the system:authenticated group write access to Kueue and cert-manager custom resources via the tekton-scheduler-role ClusterRole. When Kueue or cert-manager CRDs are present on the cluster, any authenticated user can disrupt workload scheduling, tamper with scheduling priorities, delete other tenants' Workload objects, or induce cert-manager to overwrite TLS Secrets including the default ingress controller certificate.

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: Low
Privileges needed: Low
User interaction: None

What an attacker can affect

Confidentiality: None
Integrity: Low
Availability: High

Exploit likelihood

0.22%Up 0.2 points since Jun 5, 2026

What each source reports

CVE List Score used 7.1

Openshift-pipelines-operator-rh: openshift-pipelines-operator: tekton-scheduler-rolebinding grants system:authenticated write access to kueue and cert-manager resources

Record: CVE-2026-10840
CVSS 3.1: 7.1 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H
Weakness: CWE-732, CWE-732
Updated: 2026-11-02

EUVDEUVD-2026-34248 7.1

Record: EUVD-2026-34248
CVSS 3.1: 7.1 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H
Updated: 2026-11-02

GitHub AdvisoriesGHSA-35w7-q98m-gqgx 9.6

A flaw was found in the OpenShift Pipelines operator. The tekton-scheduler-rolebinding...

Record: GHSA-35w7-q98m-gqgx
CVSS 3.1: 9.6 CriticalCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:H
Weakness: CWE-732
Updated: 2026-11-02

NVD 7.1

Record: CVE-2026-10840
CVSS 3.1: 7.1 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H
Weakness: CWE-732
Updated: 2026-11-02

Affected products

History

History
Recorded	Changed	Sources
Nov 2, 2026	first indexed	CVE List, EUVD, GitHub Advisories, NVD

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2026-10840 is a high vulnerability (CVSS 7.1) in Red Hat Openshift Pipelines, published June 4, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.22%, the 12th percentile. No source names a fixed version.