EUVD-2026-34249
GHSA-6w74-qhw6-wmwc
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessCompromise operator credential (leak/SSRF/CI)
-
DeliveryAuthenticate to AWS API with minted key
-
ExploitEnumerate account-wide resources outside cluster scope
-
ExecutionInvoke destructive EC2/IAM/S3 actions
-
ImpactDestroy or hijack unrelated workloads in AWS account
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V8 - Authorization Unnecessary privilege execution
|
| Exploitation Conditions | Requires the OpenShift cluster to be installed and running with the Cloud Credential Operator in Mint mode on AWS (not Passthrough and not Manual/STS), and requires the attacker to have already obtained valid AWS credentials of a CCO-minted operator principal (PR:H in the CVSS vector). Limiting factors: clusters using STS/IRSA or Manual mode are not exposed; exploitation does not work pre-authentication and there is no user-interaction vector; impact is bounded by what destructive AWS API actions the specific minted policy includes, but those policies are over-broad by design in the vulnerable configuration. |
| Impact | The CVSS 7.2 vector (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) reflects that exploitation requires high privileges - namely, prior compromise of the operator credentials - but then yields full confidentiality, integrity, and availability impact. This is not a remote pre-auth bug and EPSS / KEV signals are absent from the provided data, so it is not a drop-everything emergency; however, the scope-amplification nature means a relatively common incident (leaked operator key, SSRF to IMDS, compromised node) is upgraded from cluster-level to AWS-account-level damage, which is materially worse than the base score suggests. CVSS scope is marked Unchanged (S:U), which arguably understates real risk because the security boundary crossed is the cluster→AWS-account trust boundary; defenders should treat the practical impact as scope-changing even though the vector does not. No conflicting signals were observed in the provided sources, but POC availability and active-exploitation status are unknown from the inputs. |
| Exploit ScenarioDerived | An attacker obtains the AWS credentials of a cluster operator - for example via a leaked kubeconfig, a pod-level SSRF to the node's instance metadata service, or a compromised CI pipeline with cluster admin - and then uses those credentials directly against the AWS API. Because the minted policy permits destructive verbs account-wide, the attacker terminates EC2 instances, deletes S3 buckets, or detaches IAM policies belonging to unrelated workloads in the same AWS account, escalating a single-cluster compromise into account-wide disruption. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jun 04, 2026
Privilege escalation in Red Hat OpenShift's Cloud Credential Operator (CCO) Mint-mode on AWS allows an attacker who compromises operator credentials to perform destructive actions across the entire AWS account rather than only cluster-owned resources. The over-privileged IAM policies break least-privilege boundaries, turning a single cluster credential leak into an account-wide blast radius. No public exploit identified at time of analysis, and the issue is not currently listed in CISA KEV.
RemediationAI
Patch status from input data: no vendor-released fixed version is enumerated in the provided references, so treat this as patch available per vendor advisory and consult https://access.redhat.com/security/cve/CVE-2026-10843 plus Bugzilla 2484738 for the exact errata and fixed CCO/OCP versions. As a primary mitigation, migrate the cluster from Mint mode to Manual mode with AWS STS (IRSA-style short-lived tokens), which removes the long-lived account-wide admin credential entirely; the trade-off is an installation/upgrade workflow change and requires pre-provisioning per-component IAM roles. As a compensating control while patching, tighten the CCO admin IAM policy and the minted component policies with resource-ARN constraints and condition keys scoped to the cluster's infrastructure tag (e.g., kubernetes.io/cluster/<infraID>=owned), rotate any potentially exposed credentials, and enable CloudTrail alerting on destructive IAM/EC2 actions performed by CCO-managed principals - these constrain blast radius but do not eliminate the underlying over-permissioning.
Affected ProductsAI
Red Hat OpenShift Container Platform deployments on AWS that configure the Cloud Credential Operator in Mint mode are affected; clusters using Passthrough or Manual (STS/AssumeRole) credential modes are not in the same exposure class. No specific CPE strings or exact OCP version ranges were included in the provided NVD data - refer to the Red Hat advisory at https://access.redhat.com/security/cve/CVE-2026-10843 and bug https://bugzilla.redhat.com/show_bug.cgi?id=2484738 for the authoritative affected-version matrix.
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The Cloud Credential Operator manages cloud provider credentials for OpenShift cluster components. In Mint-mode on AWS, CCO uses an admin-level credential to dynamically create scoped IAM users/policies for in-cluster operators (registry, ingress, machine-API, etc.). The root cause is CWE-250 (Execution with Unnecessary Privileges): the IAM policy templates grant destructive actions (e.g., delete/terminate verbs against EC2, IAM, S3, ELB) without resource-level ARN constraints or condition keys tying them to the cluster's tag/owner, so the resulting principals can act on any resource in the AWS account, not just those the cluster owns. Red Hat tracks the issue in Bugzilla 2484738 and via the access.redhat.com CVE page.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Primary rating from Vendor (redhat).
CVSS VectorVendor: redhat
DescriptionCVE.org
A flaw was found in the OpenShift Cloud Credential Operator Mint-mode IAM policies for AWS. Operator credentials are provisioned with account-wide scope for destructive actions rather than being restricted to cluster-owned resources, enabling cross-scope impact after credential compromise.
Executive ViewAI
Red Hat OpenShift's Cloud Credential Operator (CCO) in Mint-mode on AWS contains a privilege escalation flaw that transforms a compromised operator credential into full AWS account access, eliminating the intended least-privilege boundary between cluster and account scope. Organizations running OpenShift on AWS face account-wide blast radius-including potential deletion of entire infrastructure-from a single credential leak or breach. Immediate action is required to prevent credential exposure from becoming a complete cloud environment compromise.
No vendor-released patch identified at time of analysis. Interim mitigations: (1) restrict CCO AWS IAM policy to minimum permissions scoped strictly to cluster-owned resources, blocking account-wide actions; (2) enable CloudTrail logging with real-time alerting on CCO credential use; (3) rotate CCO credentials every 90 days; (4) isolate CCO credentials from other service accounts using separate AWS IAM roles; (5) monitor AWS account for unexpected API calls via CloudWatch or SIEM; (6) consider AWS Security Token Service credentials with 15-minute session TTLs to minimize blast radius if credentials are compromised.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Privilege escalation occurs when an attacker leverages flaws in access control mechanisms to gain permissions beyond what they were originally granted.
Exploit-DB