EUVD-2026-74894
GHSA-q9g8-x2gv-frw5
Severity by source
CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
AC:H for provisioning-only exploitation window; PR:L for namespace credentials; S:C for cluster-scope privilege escalation beyond the namespace.
Primary rating from Vendor (purestorage).
CVSS VectorVendor: purestorage
Lifecycle Timeline
2DescriptionCVE.org
A privilege-escalation issue in the Portworx Operator when deployed on Red Hat OpenShift (OCP). Only under specific conditions during the initial provisioning of a Portworx storage cluster, a user holding only limited, namespace-scoped permissions could cause the operator to grant broader access than intended, potentially resulting in elevated privileges within the Kubernetes cluster.
AnalysisAI
Privilege escalation in the Portworx Operator on Red Hat OpenShift (OCP) allows a low-privileged, namespace-scoped user to cause the operator to assign cluster-wide permissions beyond what the user was authorized to hold. The flaw (CWE-266, Incorrect Privilege Assignment) is constrained to the initial provisioning phase of a Portworx storage cluster, meaning the exploitation window is finite but deliberate timing by an insider or a compromised account could reliably hit it. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires three specific concurrent conditions to hold simultaneously: (1) the Portworx Operator must be deployed on Red Hat OpenShift (OCP) - other Kubernetes distributions are not mentioned as affected; (2) a Portworx storage cluster must be undergoing initial provisioning - exploitation is not possible against already-provisioned, steady-state clusters; and (3) the attacker must hold at least limited namespace-scoped permissions within the relevant OpenShift project (PR:L per CVSS). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.0 base score of 7.7 with AT:P (specific attack timing requirements) captures the conditional nature of this vulnerability - exploitation is possible only during the narrow window of initial Portworx storage-cluster provisioning, not against an already-running cluster, which meaningfully reduces persistent attack surface compared to an always-exploitable privilege escalation. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | The primary remediation is to apply the vendor-supplied patch documented in the Pure Storage security bulletin at https://support.everpuredata.com/r/security-bulletins/security-bulletins. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, identify all Portworx Operator deployments on OpenShift in your environment and document which user accounts and service principals have permission to initiate cluster provisioning. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Kubernetes
View allA critical vulnerability in Kubernetes ingress-nginx controller allows unauthenticated attackers with pod network access
Credential-harvesting malware compromised 84 versions of 42 TanStack npm packages on 2026-05-11 via chained GitHub Actio
Kubernetes ingress-nginx contains a configuration injection vulnerability via the mirror-target and mirror-host Ingress
A security issue was discovered in ingress-nginx https://github.com/kubernetes/ingress-nginx where the `auth-url` Ingres
A security issue was discovered in ingress-nginx https://github.com/kubernetes/ingress-nginx where the `auth-tls-match-c
Kubernetes API server in all versions allow an attacker who is able to create a ClusterIP service and set the spec.exter
A security issue was discovered in Kubernetes where a user that can create pods on Windows nodes may be able to escalate
Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. Rated critical severity (CVSS 9.9), this vulne
Unauthenticated remote attackers can trigger complete database overwrites, server-side file reads, and SSRF attacks agai
The Kubernetes integration in GitLab Enterprise Edition 11.x before 11.2.8, 11.3.x before 11.3.9, and 11.4.x before 11.4
Fluentd configuration injection in the kube-logging Logging operator before 6.6.0 allows a namespace-scoped user who can
Kyverno Kubernetes policy engine prior to 1.x has a privilege escalation vulnerability (CVSS 9.9) allowing policy bypass
Same weakness CWE-266 – Incorrect Privilege Assignment
View allSame technique Privilege Escalation
View allShare
External POC / Exploit Code
Leaving vuln.today