{"id":"CVE-2026-10843","aliases":["EUVD-2026-34249","GHSA-6w74-qhw6-wmwc"],"status":"published","title":"Cloud-credential-operator: cco mint-mode credentialsrequest manifests grant account-wide iam access beyond cluster scope on aws","description":"A flaw was found in the OpenShift Cloud Credential Operator Mint-mode IAM policies for AWS. Operator credentials are provisioned with account-wide scope for destructive actions rather than being restricted to cluster-owned resources, enabling cross-scope impact after credential compromise.","severity":{"version":"3.1","score":7.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.00328,"percentile":0.26144,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-250"],"published":"2026-06-04T12:04:49Z","modified":"2026-10-30T16:17:37Z","products":[{"vendor":"red hat","product":"red hat openshift container platform 4"},{"vendor":"red hat","product":"red hat openshift container platform 5"}],"references":[{"url":"https://access.redhat.com/security/cve/CVE-2026-10843","tags":["vdb-entry","x_refsource_REDHAT"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2484738","tags":["issue-tracking","x_refsource_REDHAT"]},{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-10843.json","tags":["x_sadp-csaf-vex"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-10843"},{"url":"https://github.com/advisories/GHSA-6w74-qhw6-wmwc"}],"sources":{"cve":[{"id":"CVE-2026-10843","title":"Cloud-credential-operator: cco mint-mode credentialsrequest manifests grant account-wide iam access beyond cluster scope on aws","description":"A flaw was found in the OpenShift Cloud Credential Operator Mint-mode IAM policies for AWS. Operator credentials are provisioned with account-wide scope for destructive actions rather than being restricted to cluster-owned resources, enabling cross-scope impact after credential compromise.","status":"published","published":"2026-06-04T12:04:49.706Z","modified":"2026-10-30T15:41:06.705Z","cvss":[{"version":"3.1","score":7.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"cna"},{"version":"3.1","score":7.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"adp"}],"cwes":["CWE-250","CWE-250"],"updated_at":"2026-11-02T13:40:12.486331Z"}],"euvd":[{"id":"EUVD-2026-34249","description":"A flaw was found in the OpenShift Cloud Credential Operator Mint-mode IAM policies for AWS. Operator credentials are provisioned with account-wide scope for destructive actions rather than being restricted to cluster-owned resources, enabling cross-scope impact after credential compromise.","status":"published","published":"2026-06-04T12:04:49Z","modified":"2026-10-30T15:41:06Z","cvss":[{"version":"3.1","score":7.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T16:59:06.268136Z"}],"ghsa":[{"id":"GHSA-6w74-qhw6-wmwc","title":"A flaw was found in the OpenShift Cloud Credential Operator Mint-mode IAM policies for AWS....","description":"A flaw was found in the OpenShift Cloud Credential Operator Mint-mode IAM policies for AWS. Operator credentials are provisioned with account-wide scope for destructive actions rather than being restricted to cluster-owned resources, enabling cross-scope impact after credential compromise.","status":"published","published":"2026-06-04T12:30:26Z","modified":"2026-06-30T03:38:00Z","cvss":[{"version":"3.1","score":7.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-250"],"updated_at":"2026-11-02T15:09:05.934873Z"}],"nvd":[{"id":"CVE-2026-10843","description":"A flaw was found in the OpenShift Cloud Credential Operator Mint-mode IAM policies for AWS. Operator credentials are provisioned with account-wide scope for destructive actions rather than being restricted to cluster-owned resources, enabling cross-scope impact after credential compromise.","status":"published","published":"2026-06-04T12:16:24.97Z","modified":"2026-10-30T16:17:37.4Z","cvss":[{"version":"3.1","score":7.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"secondary"},{"version":"3.1","score":7.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"secondary"}],"cwes":["CWE-250"],"updated_at":"2026-11-02T14:12:22.022466Z"}]}}