Bug 2499647 (CVE-2026-15584)
| Summary: | CVE-2026-15584 RedHatInsights/incluster-checks: incluster-checks: Privileged host-chroot debug pods created in shared default namespace enable privilege escalation to node root | ||
|---|---|---|---|
| Product: | [Other] Security Response | Reporter: | OSIDB Bzimport <bzimport> |
| Component: | vulnerability | Assignee: | Product Security <prodsec-ir-bot> |
| Status: | NEW --- | QA Contact: | |
| Severity: | high | Docs Contact: | |
| Priority: | high | ||
| Version: | unspecified | CC: | derez |
| Target Milestone: | --- | Keywords: | Security |
| Target Release: | --- | ||
| Hardware: | All | ||
| OS: | Linux | ||
| Whiteboard: | |||
| Fixed In Version: | Doc Type: | --- | |
| Doc Text: |
A privilege escalation vulnerability was found in the incluster-checks tool for OpenShift. The tool creates privileged debug pods with host filesystem access in the shared default namespace, where any user with the standard edit role can exec into them and obtain root access on cluster nodes.
|
Story Points: | --- |
| Clone Of: | Environment: | ||
| Last Closed: | Type: | --- | |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
The incluster-checks Python CLI tool spawns privileged debug pods on every node of an OpenShift cluster using `oc debug node/<name>`. These pods run with hostPID, hostNetwork, privileged securityContext, and the host root filesystem mounted at /host, then execute `bash -c "chroot /host <cmd>"` inside them. The pods are created in the `default` namespace by default. The `default` namespace on OpenShift is shared and broadly accessible — any user with the standard `edit` ClusterRole (the most common developer-facing role) has `pods/exec` permission there. CIS Kubernetes Benchmark 5.7.4 explicitly warns against running workloads in the `default` namespace because RBAC is broadly scoped. During a check run (or during the up-to-4-hour orphan window if cleanup is interrupted), any cluster user with `edit` access can `oc exec` into these privileged pods and obtain root access on every cluster node. No additional vulnerability or unusual access level is required. ```python # src/in_cluster_checks/core/executor.py class NodeExecutor: def __init__(self, node_name: str, namespace: str = "default", ...): self.namespace = namespace ``` The tool ships no Namespace, PodSecurity label, NetworkPolicy, or RBAC manifest to isolate these workloads. Affected file: `src/in_cluster_checks/core/executor.py:99-213` in https://github.com/RedHatInsights/incluster-checks Remediation: Ship a dedicated namespace manifest labelled with PodSecurity enforcement, add a default-deny NetworkPolicy, restrict pods/exec via RBAC to the invoking ServiceAccount, and refuse to run against the `default` namespace.