Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
A flaw was found in the OpenShift Pipelines operator. The tekton-scheduler-rolebinding ClusterRoleBinding grants the system:authenticated group write access to Kueue and cert-manager custom resources via the tekton-scheduler-role ClusterRole. When Kueue or cert-manager CRDs are present on the cluster, any authenticated user can disrupt workload scheduling, tamper with scheduling priorities, delete other tenants' Workload objects, or induce cert-manager to overwrite TLS Secrets including the default ingress controller certificate.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
AVAILABLE
Momentum
STABLE
| Date | Total | Labels |
|---|
| 2026-06-04 | 1 | Patch1 |
| 2026-07-25 | 1 | Disclosure1 |
🚨 CVE-2026-10840 — CVSS 9.6/10 ██████████ A flaw was found in the OpenShift Pipelines operator. The tekton-scheduler-rolebinding ClusterRoleBinding grants the... Severity: CRITICAL Patch now. #cybersecurity #CVE https://t.co/YdmYqJHte2
Post summary
Highlights a critical CVE (9.6) affecting OpenShift Pipelines operator and states a patch is now available.
🐛 VULNERABILITIES CVE Notify: 🚨 [CVE-2026-10840](https://access.redhat.com/errata/RHSA-2026:36648) A flaw was found in the OpenSh... https://access.redhat.com/errata/RHSA-2026:36648 #ZeroDay #PatchManagement #Vulnerability
Post summary
The post announces the discovery of CVE-2026-10840, referencing a Red Hat errata link but providing no further technical or exploitation details.