OpenShift Container Platform EUVD-2026-94581

Exploitation is strictly conditional and not standalone: the attacker must FIRST compromise the cluster-samples-operator pod or obtain its service-account token through a separate, unrelated vulnerability. Given that foothold, the specific weakness is that the RBAC Role 'coreos-pull-secret-reader' in the 'openshift-config' namespace grants get/list/watch on ALL Secret resources with no resourceNames restriction, whereas the operator only needs the single 'pull-secret' Secret. The limiting factors that reduce real-world risk: (1) requires valid possession of the operator's service-account credentials (PR:L - not unauthenticated), (2) no initial access is provided by this flaw itself, (3) impact is confined to reading Secrets in the openshift-config namespace, and (4) impact is confidentiality-only with no write or availability effect.

This is a defense-in-depth / excessive-privilege weakness (CWE-250) rather than a directly exploitable vulnerability. The provided CVSS 3.1 vector (AV:A/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N) yields 6.8 (Medium), but the single most important signal is that exploitation is explicitly conditional: the description states the flaw is only reachable 'if the samples-operator pod or its service account token is compromised through a separate vulnerability.' It is therefore a privilege/impact amplifier that chains off a prior compromise, not a standalone entry point. No EPSS score, SSVC decision, KEV listing, or POC was supplied, so exploitation status is 'no public exploit identified at time of analysis' - there is no evidence of active exploitation or weaponization. Note a tension in the input data: the vector specifies AV:A (adjacent network), yet the described attack is in-cluster abuse of a compromised service-account token, which is a local vector (AV:L) - verify the vector with Red Hat. PR:L is consistent with the requirement that the attacker already hold the operator's service-account credentials. Overall this is a legitimate hardening fix (reduce RBAC to the single pull-secret via resourceNames scoping) but a low real-world priority as a primary target: impact is confidentiality-only (C:H, I:N, A:N) and is gated behind an independent initial-access bug.

An attacker who has already compromised the cluster-samples-operator pod or stolen its service-account token through a separate vulnerability uses the over-scoped coreos-pull-secret-reader role to list and read every Secret in the openshift-config namespace, not just the intended pull-secret. The harvested secrets can include OAuth identity-provider credentials and cloud-provider credentials, enabling broader cluster or cloud account compromise. No public exploit code was identified; exploitation requires the prerequisite operator/token compromise.