Bug 2484720 (CVE-2026-10840)

Summary: CVE-2026-10840 openshift-pipelines-operator-rh: openshift-pipelines-operator: tekton-scheduler-rolebinding grants system:authenticated write access to Kueue and cert-manager resources
Product: [Other] Security Response Reporter: OSIDB Bzimport <bzimport>
Component: vulnerabilityAssignee: Product Security <prodsec-ir-bot>
Status: NEW --- QA Contact:
Severity: high Docs Contact:
Priority: high    
Version: unspecifiedKeywords: Security
Target Milestone: ---   
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: ---
Doc Text:
A flaw was found in the OpenShift Pipelines operator. The tekton-scheduler-rolebinding ClusterRoleBinding grants the system:authenticated group write access to Kueue and cert-manager custom resources via the tekton-scheduler-role ClusterRole. When Kueue or cert-manager CRDs are present on the cluster, any authenticated user can disrupt workload scheduling, tamper with scheduling priorities, delete other tenants' Workload objects, or induce cert-manager to overwrite TLS Secrets including the default ingress controller certificate.
 Story Points: ---
Clone Of: Environment:
Last Closed: Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:

Description OSIDB Bzimport 2026-06-04 11:30:07 UTC 
A flaw was found in the OpenShift Pipelines operator (tektoncd/operator). The operator ships a ClusterRoleBinding (tekton-scheduler-rolebinding) that binds ClusterRole/tekton-scheduler-role to the system:authenticated group, granting all authenticated users cluster-wide create/update/patch/delete permissions on kueue.x-k8s.io resources (ResourceFlavor, Workload, WorkloadPriorityClass) and create/update permissions on cert-manager.io resources (Certificate, Issuer). When Kueue CRDs are present (e.g., via RHOAI), any authenticated user can disrupt cross-tenant workload scheduling by deleting ResourceFlavors, destroy other tenants' Workload objects, or tamper with scheduling priority. When cert-manager is installed, any authenticated user can create Certificate objects targeting arbitrary Secrets, including the default ingress controller's TLS Secret (openshift-ingress/router-certs-default), causing cert-manager to overwrite it with an attacker-influenced certificate. This confused deputy attack crosses authorization boundaries — the attacker cannot write Secrets directly but leverages cert-manager's ServiceAccount to do so. The RBAC objects are installed unconditionally even when the Tekton Scheduler feature is disabled.