What is the CVSS score of CVE-2026-10840?

CVE-2026-10840 has a CVSS 3.1 base score of 7.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H. EPSS exploitation probability: 0.0%.

How to fix or mitigate CVE-2026-10840?

Within 24 hours: Inventory all Red Hat OpenShift Pipelines operator deployments and current versions; audit tekton-scheduler-rolebinding permissions and document affected service accounts. Within 7 days: Remove write permissions to Kueue and cert-manager resources from tekton-scheduler-rolebinding ClusterRoleBinding; restrict system:authenticated privileges through RBAC modification; enable audit logging on modified resources. Within 30 days: Monitor Red Hat security advisories for patch release; develop and test upgrade procedures; evaluate alternative scheduling platforms if patch availability extends beyond acceptable risk tolerance.

CVE-2026-10840

EUVD-2026-34248 HIGH

Incorrect Permission Assignment for Critical Resource (CWE-732)

2026-06-04 secalert@redhat.com

GHSA-35w7-q98m-gqgx

Information Disclosure

7.1

CVSS 3.1 · Vendor: redhat

Severity by source

Vendor (redhat) PRIMARY

7.1 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H

Red Hat

9.6 HIGH

qualitative

Primary rating from Vendor (redhat).

CVSS VectorVendor: redhat

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

High

Lifecycle Timeline

Analysis Updated

Jun 09, 2026 - 09:28 vuln.today

v3 (cvss_changed)

Analysis Updated

Jun 09, 2026 - 09:27 vuln.today

v2 (cvss_changed)

Re-analysis Queued

Jun 09, 2026 - 09:22 vuln.today

cvss_changed

Severity Changed

Jun 09, 2026 - 09:22 NVD

CRITICAL HIGH

CVSS changed

Jun 09, 2026 - 09:22 NVD

9.6 (CRITICAL) 7.1 (HIGH)

Analysis Generated

Jun 04, 2026 - 12:30 vuln.today

DescriptionCVE.org

A flaw was found in the OpenShift Pipelines operator. The tekton-scheduler-rolebinding ClusterRoleBinding grants the system:authenticated group write access to Kueue and cert-manager custom resources via the tekton-scheduler-role ClusterRole. When Kueue or cert-manager CRDs are present on the cluster, any authenticated user can disrupt workload scheduling, tamper with scheduling priorities, delete other tenants' Workload objects, or induce cert-manager to overwrite TLS Secrets including the default ingress controller certificate.

AnalysisAI

Privilege escalation via overly permissive RBAC in Red Hat OpenShift Pipelines operator allows any authenticated cluster user to write to Kueue and cert-manager custom resources, enabling disruption of multi-tenant workload scheduling and tampering with cluster TLS certificates. The flaw stems from the tekton-scheduler-rolebinding ClusterRoleBinding granting system:authenticated overly broad write permissions. EPSS is very low (0.02%) and there is no public exploit identified at time of analysis, but the attack requires only basic cluster authentication.