Bug 2523035 (CVE-2026-107176)

Summary: CVE-2026-107176 cluster-samples-operator: Role reads ALL secrets in openshift-config, not just pull-secret
Product: [Other] Security Response Reporter: OSIDB Bzimport <bzimport>
Component: vulnerabilityAssignee: Product Security <prodsec-ir-bot>
Status: NEW --- QA Contact:
Severity: medium Docs Contact:
Priority: medium    
Version: unspecifiedCC: akhatavk, aos-team-art-private, asdas, dpaolell, jdelft, jupierce, lgarciaa, mbiarnes, ppalepu, ppostler, prdhamdh, security-response-team, sghai, sidsharm, suppawar, vlaad
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: ---
Doc Text:
A flaw was found in the cluster-samples-operator. The RBAC Role coreos-pull-secret-reader in namespace openshift-config grants get, list, and watch permissions on all Secret resources without resourceNames scoping. The operator only requires access to the pull-secret Secret. If the samples-operator pod or its service account token is compromised through a separate vulnerability, an attacker could read all secrets in openshift-config, potentially including OAuth identity provider credentials, cloud provider credentials, and other sensitive cluster configuration.
 Story Points: ---
Clone Of: Environment:
Last Closed: Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:

Description OSIDB Bzimport 2026-08-24 19:26:00 UTC 
## Operator SA granted read on all Secrets in openshift-config namespace

**CWEs:** CWE-269, CWE-732
**CVSS:** 7.1 (CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N)
**Component:** openshift-5.0-payload/cluster-samples-operator__release-5.0

### Description
The Role coreos-pull-secret-reader in namespace openshift-config grants get/list/watch on the entire secrets resource without a resourceNames restriction. The operator only ever reads the single Secret named 'pull-secret' (pkg/metrics/metrics.go:182, pkg/client/listers.go ConfigNamespaceSecrets informer). openshift-config holds high-value cluster credentials including OAuth IdP client secrets, htpasswd files, additional CA bundles, and cloud-provider credentials, so a compromise of the samples-operator pod or its token yields read access to all of them.

### Affected Locations
- `:`

### Evidence
**manifests/05-kube-system-rbac.yaml:10-18 — no resourceNames scoping**
```yaml
rules:
- apiGroups:
  - ""
  resources:
  - secrets
  verbs:
  - get
  - list
  - watch
```

### Attack Pattern
Code-exec or token theft in the samples-operator pod → list/get every Secret in openshift-config → exfiltrate IdP/OAuth/cloud credentials.

---
*Source: Ex-Wing security assessment, finding FIND-001*