CVE-2026-107176

MediumCVSS 6.8/10Last modified Oct 8, 2026

Description

A flaw was found in the cluster-samples-operator. The RBAC Role coreos-pull-secret-reader in namespace openshift-config grants get, list, and watch permissions on all Secret resources without resourceNames scoping. The operator only requires access to the pull-secret Secret. If the samples-operator pod or its service account token is compromised through a separate vulnerability, an attacker could read all secrets in openshift-config, potentially including OAuth identity provider credentials, cloud provider credentials, and other sensitive cluster configuration.

Metrics

CVSS 3.1 6.8/10CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N

Weakness enumeration

CWE-250

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

No affected versions have been published.

Timeline

Published: Oct 7, 2026
Last modified: Oct 8, 2026
NVD status: Awaiting Analysis

Related CVEs from 2026

CVE-2026-1071775.9Express Gateway through 1.16.11 contains a hardcoded cryptographic key vulnerability that allows attackers with datastore access to decrypt CVE-2026-1071786.8The Image Photo Gallery Final Tiles Grid WordPress plugin before 3.6.16 does not escape gallery lightbox configuration values before printin CVE-2026-107184.6Out of bounds write in openSeaChest’s Trim/Unmap operation in Seagate’s openSeaChest v26.03.0 on all supported platforms allows for writing CVE-2026-1071807.1On MISP instances configured to require TOTP enrolment (Security.otp_required), the enforcement of the mandatory two-factor authentication s CVE-2026-1071818.1Telegram Desktop before 7.2.9 contains an IPC record-separator injection vulnerability in Core::Sandbox that allows remote attackers to inje CVE-2026-1071838.1llama.cpp before b11393 contains a use-after-free and double free vulnerability in common_chat_peg_mapper::map that allows unauthenticated r CVE-2026-1071868.6An unauthenticated user can send a DWR request with isPasswordUppercase as one call method and the next call method can be set to a run work CVE-2026-1071878.5A user can access any database details, such as usernames and passwords by sending a DWR request with a specified workflow rule. The authent CVE-2026-1071889.6A user can upload export reports with any file contents and specify any contents. JSP code can be uploaded, JSPX can be specified as the fil CVE-2026-107191.8Out of bounds write in openSeaChest’s --showSupportedFormats in Seagate’s openSeaChest v25.05.3 on all supported platforms allows for writin CVE-2026-1071936.5A flaw has been found in **permission filters** in the **foreman** package. The API loads a filter by its identifier and does not apply the CVE-2026-1071949.2Sungrow iSolarCloud before 2026-08-25 allows authentication bypass and account takeover via "login_type":"5" in a login request, potentially