CVE-2026-107176

A flaw was found in the cluster-samples-operator. The RBAC Role coreos-pull-secret-reader in namespace openshift-config grants get, list, and watch permissions on all Secret resources without resourceNames scoping. The operator only requires access to the pull-secret Secret. If the samples-operator pod or its service account token is compromised through a separate vulnerability, an attacker could read all secrets in openshift-config, potentially including OAuth identity provider credentials, cloud provider credentials, and other sensitive cluster configuration.

CVSS v3 6.8 MEDIUM

6.8^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.3 / Impact : 4.0

Attack Vector ADJACENT_NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

Scope CHANGED

References

Link	Resource
https://access.redhat.com/errata/RHSA-2026:89198
https://access.redhat.com/errata/RHSA-2026:89341
https://access.redhat.com/errata/RHSA-2026:89626
https://access.redhat.com/security/cve/CVE-2026-107176
https://bugzilla.redhat.com/show_bug.cgi?id=2523035

Configurations

No configuration.

History

29 Oct 2026, 22:17

Type	Values Removed	Values Added
References		() https://access.redhat.com/errata/RHSA-2026:89198 - () https://access.redhat.com/errata/RHSA-2026:89341 - () https://access.redhat.com/errata/RHSA-2026:89626 -

07 Oct 2026, 20:17

Type	Values Removed	Values Added
New CVE

Information

Published : 2026-10-07 20:17

Updated : 2026-10-30 08:16

NVD link : CVE-2026-107176

Mitre link : CVE-2026-107176

CVE.ORG link : CVE-2026-107176

JSON object : View

Products Affected

No product.

CWE

CWE-250

Execution with Unnecessary Privileges

{"id": "CVE-2026-107176", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-107176", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-10-07T19:59:03.424144Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "secalert@redhat.com", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 6.8, "attackVector": "ADJACENT_NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 4.0, "exploitabilityScore": 2.3}]}, "affected": [{"source": "secalert@redhat.com", "affectedData": [{"cpes": ["cpe:/a:redhat:openshift:4.20::el9"], "vendor": "Red Hat", "product": "Red Hat OpenShift Container Platform 4.20", "versions": [{"status": "unaffected", "version": "1792826398", "lessThan": "*", "versionType": "rpm"}], "packageName": "openshift4/ose-cluster-samples-rhel9-operator", "collectionURL": "https://catalog.redhat.com/software/containers/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:openshift:4.21::el9"], "vendor": "Red Hat", "product": "Red Hat OpenShift Container Platform 4.21", "versions": [{"status": "unaffected", "version": "1792852494", "lessThan": "*", "versionType": "rpm"}], "packageName": "openshift4/ose-cluster-samples-rhel9-operator", "collectionURL": "https://catalog.redhat.com/software/containers/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:openshift:4.22::el9"], "vendor": "Red Hat", "product": "Red Hat OpenShift Container Platform 4.22", "versions": [{"status": "unaffected", "version": "1792770602", "lessThan": "*", "versionType": "rpm"}], "packageName": "openshift4/ose-cluster-samples-rhel9-operator", "collectionURL": "https://catalog.redhat.com/software/containers/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:openshift:4"], "vendor": "Red Hat", "product": "Red Hat OpenShift Container Platform 4", "packageName": "openshift4/ose-cluster-samples-operator", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:openshift:5"], "vendor": "Red Hat", "product": "Red Hat OpenShift Container Platform 5", "packageName": "openshift5/ose-cluster-samples-rhel9-operator", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected"}]}], "published": "2026-10-07T20:17:11.153", "references": [{"url": "https://access.redhat.com/errata/RHSA-2026:89198", "source": "secalert@redhat.com"}, {"url": "https://access.redhat.com/errata/RHSA-2026:89341", "source": "secalert@redhat.com"}, {"url": "https://access.redhat.com/errata/RHSA-2026:89626", "source": "secalert@redhat.com"}, {"url": "https://access.redhat.com/security/cve/CVE-2026-107176", "source": "secalert@redhat.com"}, {"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2523035", "source": "secalert@redhat.com"}], "vulnStatus": "Awaiting Analysis", "weaknesses": [{"type": "Secondary", "source": "secalert@redhat.com", "description": [{"lang": "en", "value": "CWE-250"}]}], "descriptions": [{"lang": "en", "value": "A flaw was found in the cluster-samples-operator. The RBAC Role coreos-pull-secret-reader in namespace openshift-config grants get, list, and watch permissions on all Secret resources without resourceNames scoping. The operator only requires access to the pull-secret Secret. If the samples-operator pod or its service account token is compromised through a separate vulnerability, an attacker could read all secrets in openshift-config, potentially including OAuth identity provider credentials, cloud provider credentials, and other sensitive cluster configuration."}], "lastModified": "2026-10-30T08:16:54.057", "sourceIdentifier": "secalert@redhat.com"}