Openshift-pipelines-operator-rh: openshift-pipelines-operator: tekton-scheduler-rolebinding grants system:authenticated write access to kueue and cert-manager resources
- Published
- Last modified
- Where the record stands: published, rejected by its publisher, or superseded by another id.What do these mean? →
- published
- Whether CISA lists it in its Known Exploited Vulnerabilities catalog: proof that attackers are using it.What do these mean? →
- Not listed in CISA KEV
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- None on Exploit-DB, Metasploit or GitHub
- Exploitation: none
- Automatable: no
- Technical impact: partial
Summary
A flaw was found in the OpenShift Pipelines operator. The tekton-scheduler-rolebinding ClusterRoleBinding grants the system:authenticated group write access to Kueue and cert-manager custom resources via the tekton-scheduler-role ClusterRole. When Kueue or cert-manager CRDs are present on the cluster, any authenticated user can disrupt workload scheduling, tamper with scheduling priorities, delete other tenants' Workload objects, or induce cert-manager to overwrite TLS Secrets including the default ingress controller certificate.
Timeline
- CVE published
- CISA SSVC assessment
Exploitation: none · Automatable: no · Technical impact: partial
- Record last updated
Affected versions
- openshift-builds/openshift-builds-rhel9-operator
Version range not reported
- openshift-builds/openshift-builds-rhel9-operator
Version range not reported
- openshift-pipelines/pipelines-operator-proxy-rhel8
Version range not reported
- openshift-pipelines/pipelines-operator-proxy-rhel9
Version range not reported
- openshift-pipelines/pipelines-operator-webhook-rhel8
Version range not reported
- openshift-pipelines/pipelines-operator-webhook-rhel9
Version range not reported
- openshift-pipelines/pipelines-rhel8-operator
Version range not reported
- openshift-pipelines/pipelines-rhel9-operator
Version range not reported