GO-2026-6612 vulnerabilities

Vulnerabilities for packages: ratify-fips, portieris-fips, rabbitmq-cluster-operator, crossplane-provider-aws-fis-fips, contour-fips, crossplane-provider-kubernetes, crossplane-provider-aws-inspector, seaweedfs-operator-fips, rollouts-plugin-trafficrouter-gatewayapi, apko,...

GO-2026-6611 vulnerabilities

Vulnerabilities for packages: ratify-fips, portieris-fips, rabbitmq-cluster-operator, crossplane-provider-aws-fis-fips, contour-fips, crossplane-provider-kubernetes, crossplane-provider-aws-inspector, seaweedfs-operator-fips, rollouts-plugin-trafficrouter-gatewayapi, apko,...

GO-2026-6617 vulnerabilities

Vulnerabilities for packages: ratify-fips, portieris-fips, rabbitmq-cluster-operator, crossplane-provider-aws-fis-fips, contour-fips, crossplane-provider-kubernetes, crossplane-provider-aws-inspector, seaweedfs-operator-fips, rollouts-plugin-trafficrouter-gatewayapi, apko,...

CVE-2026-78669 vulnerabilities

Vulnerabilities for packages: ratify-fips, portieris-fips, rabbitmq-cluster-operator, crossplane-provider-aws-fis-fips, contour-fips, crossplane-provider-kubernetes, crossplane-provider-aws-inspector, seaweedfs-operator-fips, rollouts-plugin-trafficrouter-gatewayapi, apko,...

Important: Red Hat Security Advisory: Red Hat build of Kueue 1.4.3 release

Red Hat build of Kueue 1.4.3 release The Red Hat build of Kueue is an optional operator, based on Kueue upstream, to enable the installation of Kueue on Openshift. Kueue is a queueing framework for managing Kubernetes workloads. This release is based on Kueue v0.18.11...

GO-2026-5026 vulnerabilities

Vulnerabilities for packages: ratify-fips, portieris-fips, rabbitmq-cluster-operator, crossplane-provider-aws-fis-fips, contour-fips, crossplane-provider-kubernetes, crossplane-provider-aws-inspector, seaweedfs-operator-fips, rollouts-plugin-trafficrouter-gatewayapi, apko,...

GO-2026-4984 vulnerabilities

Vulnerabilities for packages: crossplane-provider-aws-organizations, cloudbeat, multus-cni-fips, k6-operator-fips, net-kourier-fips, zarf-fips, cert-manager-csi-driver-fips, ratify-fips, portieris-fips, podinfo-fips, crossplane-provider-aws-scheduler, rabbitmq-cluster-operator,...

GHSA-GCJH-H69Q-9W9G vulnerabilities

Vulnerabilities for packages: perses, image-factory, volsync-fips, envoy-ai-gateway-fips, cluster-api-aws-controller, kubescape, chainloop-artifact-cas, eks-distro, flux-notification-controller, calico, fluent-operator, kyverno, flux-operator, rancher-support-bundle-kit, harvester-fips,...

CVE-2026-10840

A flaw was found in the OpenShift Pipelines operator. The tekton-scheduler-rolebinding ClusterRoleBinding grants the system:authenticated group write access to Kueue and cert-manager custom resources via the tekton-scheduler-role ClusterRole. When Kueue or cert-manager CRDs are present on the...

CVE-2026-10840

CVE-2026-10840 concerns the OpenShift Pipelines operator. The tekton-scheduler-rolebinding ClusterRoleBinding grants the system:authenticated group write access to Kueue and cert-manager custom resources via the tekton-scheduler-role. When Kueue or cert-manager CRDs are present, any authenticated...

CVE-2026-10840 Openshift-pipelines-operator-rh: openshift-pipelines-operator: tekton-scheduler-rolebinding grants system:authenticated write access to kueue and cert-manager resources

A flaw was found in the OpenShift Pipelines operator. The tekton-scheduler-rolebinding ClusterRoleBinding grants the system:authenticated group write access to Kueue and cert-manager custom resources via the tekton-scheduler-role ClusterRole. When Kueue or cert-manager CRDs are present on the...

EUVD-2026-34248

A flaw was found in the OpenShift Pipelines operator. The tekton-scheduler-rolebinding ClusterRoleBinding grants the system:authenticated group write access to Kueue and cert-manager custom resources via the tekton-scheduler-role ClusterRole. When Kueue or cert-manager CRDs are present on the...

CVE-2026-10840 Openshift-pipelines-operator-rh: openshift-pipelines-operator: tekton-scheduler-rolebinding grants system:authenticated write access to kueue and cert-manager resources

A flaw was found in the OpenShift Pipelines operator. The tekton-scheduler-rolebinding ClusterRoleBinding grants the system:authenticated group write access to Kueue and cert-manager custom resources via the tekton-scheduler-role ClusterRole. When Kueue or cert-manager CRDs are present on the...

CVE-2026-10840

A flaw was found in the OpenShift Pipelines operator. The tekton-scheduler-rolebinding ClusterRoleBinding grants the system:authenticated group write access to Kueue and cert-manager custom resources via the tekton-scheduler-role ClusterRole. When Kueue or cert-manager CRDs are present on the...

CVE-2026-10840

A flaw was found in the OpenShift Pipelines operator. The tekton-scheduler-rolebinding ClusterRoleBinding grants the system:authenticated group write access to Kueue and cert-manager custom resources via the tekton-scheduler-role ClusterRole. When Kueue or cert-manager CRDs are present on the...

CVE-2026-10840: Incorrect Permission Assignment for Critical Resource

A flaw was found in the OpenShift Pipelines operator. The tekton-scheduler-rolebinding ClusterRoleBinding grants the system:authenticated group write access to Kueue and cert-manager custom resources via the tekton-scheduler-role ClusterRole. When Kueue or cert-manager CRDs are present on the...

PT-2026-46191

Name of the Vulnerable Software and Affected Versions OpenShift Pipelines operator affected versions not specified Description A flaw in the OpenShift Pipelines operator occurs because the tekton-scheduler-rolebinding ClusterRoleBinding grants the system:authenticated group write access to Kueue...

Red Hat OpenShift Pipelines 权限许可和访问控制问题漏洞

Red Hat OpenShift Pipelines is a Kubernetes-native continuous integration and continuous delivery platform developed by Red Hat Inc. There is a security vulnerability in Red Hat OpenShift Pipelines. This vulnerability stems from the ClusterRoleBinding for tekton-scheduler-rolebinding granting the...

CVE-2025-10725

A flaw was found in Red Hat Openshift AI Service. A low-privileged attacker with access to an authenticated account, for example as a data scientist using a standard Jupyter notebook, can escalate their privileges to a full cluster administrator. This allows for the complete compromise of the...