Executive brief
A resource management flaw in Red Hat OpenShift Container Platform allows users to bypass pod limits. By creating a large number of short-lived tasks, an authorized user can flood the system with event logs that are not properly restricted. This can overwhelm the central database and slow down the management interface for all users on the cluster, potentially leading to a denial of service.
Technical details
A resource exhaustion vulnerability (CWE-770) exists in OpenShift Container Platform due to improper accounting of completed pods. Specifically, pods configured with 'restartPolicy: Never' do not count toward ResourceQuota pod limits once they reach a completed state. Furthermore, Kubernetes events generated by these pods are not subject to quota scoping. A non-privileged attacker with pod creation permissions can exploit this by rapidly generating pods to flood the etcd database with events. This results in significant API server performance degradation and potential cluster-wide instability.
Affected products
- Red Hat OpenShift Container Platform
Timeline
- 2026-06-01: disclosed: CVE published by Red Hat