Executive brief
A security flaw in the Red Hat OpenShift Pipelines operator incorrectly grants all logged-in users broad administrative permissions over scheduling and certificate management tools. This allows any user with basic access to the system to disrupt company-wide computing tasks, delete other teams' work, or overwrite critical security certificates used for secure web traffic. Such an attack could lead to significant service outages and compromise the integrity of encrypted communications across the entire platform.
Technical details
A vulnerability in the OpenShift Pipelines operator (tektoncd/operator) stems from an overly permissive RBAC configuration. The 'tekton-scheduler-rolebinding' ClusterRoleBinding incorrectly binds the 'tekton-scheduler-role' ClusterRole to the 'system:authenticated' group. This grants all authenticated users cluster-wide create, update, patch, and delete permissions on Kueue resources (ResourceFlavor, Workload, WorkloadPriorityClass) and create/update permissions on cert-manager resources (Certificate, Issuer). An attacker can exploit this to disrupt cross-tenant scheduling or perform a 'confused deputy' attack by inducing cert-manager to overwrite sensitive TLS Secrets, such as the default ingress controller certificate, which the attacker could not otherwise access directly. These RBAC objects are installed even if the Tekton Scheduler feature is disabled.
Affected products
- Red Hat OpenShift Pipelines operator
Timeline
- 2026-06-04: disclosed: CVE published by Red Hat