CVE-2026-15140

HighCVSS 7.7/10Last modified Sep 9, 2026

Description

A privilege-escalation issue in the Portworx Operator when deployed on Red Hat OpenShift (OCP). Only under specific conditions during the initial provisioning of a Portworx storage cluster, a user holding only limited, namespace-scoped permissions could cause the operator to grant broader access than intended, potentially resulting in elevated privileges within the Kubernetes cluster.

Metrics

CVSS 4.0 7.7/10CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Weakness enumeration

CWE-266

Affected software

No affected versions have been published.

Timeline

Published
Sep 9, 2026
Last modified
Sep 9, 2026
NVD status
Deferred

Related CVEs from 2026

CVE-2026-151415.7The web interface of the affected device relies on the HTTP referrer header as part of request validation.  Requests containing empty RefereCVE-2026-151427.5The Real Estate Manager Pro plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 12.8.6. This isCVE-2026-151439.3A flaw was found in the file_type content detector of guardrails-detectors. This vulnerability allows a remote attacker to supply an arbitraCVE-2026-151445.3@fastify/rate-limit before 11.2.0 keys rate-limit buckets by the verbatim client IP string returned from request.ip. Because a single IPv6 cCVE-2026-151456.4The Essential Addons for Elementor – Popular Elementor Templates & Widgets plugin for WordPress is vulnerable to Stored Cross-Site ScriptingCVE-2026-151465.9GNU Wget versions < 1.25.0+4f85853f64 do not validate the IP address provided by an FTP PASV response while operating in FTP passive mode. ACVE-2026-151475.3The Five Star Restaurant Reservations WordPress plugin before 2.7.23 does not verify the authenticity of incoming payment notifications, faiCVE-2026-151485.3The WP Events Manager WordPress plugin before 2.2.5 does not verify that an incoming payment notification originates from the site's configuCVE-2026-151495.3The WP Hotel Booking WordPress plugin before 2.3.3 does not ensure that room quantities and the resulting order total are non-negative when CVE-2026-151505.3The myCred WordPress plugin before 3.2.5 does not verify that the receiver of an incoming payment gateway notification matches the site's coCVE-2026-151517.5The Five Star Restaurant Reservations WordPress plugin before 2.7.23 does not perform a capability check on one of its AJAX actions, allowiCVE-2026-151525.3The WP Hotel Booking WordPress plugin before 2.3.2 does not verify that a payment notification corresponds to a payment made to the site's o