CVE-2026-107176
Received Received - Intake

Cluster-Samples-Operator RBAC Privilege Escalation Vulnerability

Publication date: 2026-10-07

Last updated on: 2026-10-07

Assigner: redhat-SADP

Description
A flaw was found in the cluster-samples-operator. The RBAC Role coreos-pull-secret-reader in namespace openshift-config grants get, list, and watch permissions on all Secret resources without resourceNames scoping. The operator only requires access to the pull-secret Secret. If the samples-operator pod or its service account token is compromised through a separate vulnerability, an attacker could read all secrets in openshift-config, potentially including OAuth identity provider credentials, cloud provider credentials, and other sensitive cluster configuration.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-07
Last Modified
2026-10-07
Generated
2026-10-08
AI Q&A
2026-10-07
EPSS Evaluated
N/A
NVD
CVE-2026-107176
EUVD
EUVD-2026-94581

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
redhat cluster_samples_operator *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-250 The product performs an operation at a privilege level that is higher than the minimum level required, which creates new weaknesses or amplifies the consequences of other weaknesses.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is in the cluster-samples-operator where an RBAC Role named coreos-pull-secret-reader grants excessive permissions. It allows get, list, and watch access to all Secret resources in the openshift-config namespace without restricting access to only the pull-secret Secret that the operator needs. If the operator pod or its token is compromised, an attacker could read all secrets in the namespace, potentially exposing sensitive credentials like OAuth provider details or cloud provider credentials.

Detection Guidance

Check RBAC roles in the openshift-config namespace for the coreos-pull-secret-reader Role. Verify if it grants get, list, or watch permissions on all Secret resources without resourceNames scoping. Use commands like 'oc get role coreos-pull-secret-reader -n openshift-config -o yaml' to inspect the Role rules.

Impact Analysis

If an attacker compromises the samples-operator pod or its token, they could read all secrets in the openshift-config namespace. This could expose OAuth identity provider credentials, cloud provider credentials, and other sensitive cluster configuration data, leading to unauthorized access or data breaches.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data such as OAuth credentials or cloud provider secrets, which may violate compliance requirements under GDPR or HIPAA. Exposure of such credentials could result in data breaches, unauthorized access to personal or health information, and potential regulatory penalties.

Mitigation Strategies

Restrict the coreos-pull-secret-reader Role to only access the pull-secret Secret by adding resourceNames scoping. Example: 'oc patch role coreos-pull-secret-reader -n openshift-config --type='json' -p='[{"op": "add", "path": "/rules/0/resourceNames", "value": ["pull-secret"]}]''.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-107176. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart