CVE-2026-107176— Cluster-samples-operator: role reads all secrets in openshift-config, not just pull-secret
Quick assessment
Affected
Red Hat Red Hat OpenShift Container Platform 4
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
在 cluster-samples-operator 中发现了一个缺陷。位于 openshift-config 命名空间中的 RBAC Role coreos-pull-secret-reader 对所有 Secret 资源授予了 get、list 和 watch 权限，且未对资源名称（resourceNames）进行限制。然而，该 Operator 实际上仅需访问 pull-secret 这一个 Secret。如果 samples-operator Pod 或其服务账户令牌通过其他漏洞被攻陷，攻击者便可读取 op
Affected Version Matrix 2
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| Red Hat | Red Hat OpenShift Container Platform 4 | any |
affected |
any |
affected |
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-107176
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Cluster-samples-operator: role reads all secrets in openshift-config, not just pull-secret
Source: CVE Program / CVE List V5
Vulnerability Description
A flaw was found in the cluster-samples-operator. The RBAC Role coreos-pull-secret-reader in namespace openshift-config grants get, list, and watch permissions on all Secret resources without resourceNames scoping. The operator only requires access to the pull-secret Secret. If the samples-operator pod or its service account token is compromised through a separate vulnerability, an attacker could read all secrets in openshift-config, potentially including OAuth identity provider credentials, cloud provider credentials, and other sensitive cluster configuration.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
带着不必要的权限执行
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Red Hat | Red Hat OpenShift Container Platform 4 | - |
cpe:/a:redhat:openshift:4
|
|
| Red Hat | Red Hat OpenShift Container Platform 4 | - |
cpe:/a:redhat:openshift:4
|
|
II. Public POCs for CVE-2026-107176
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-107176
请登录查看更多情报信息。
Vendor Advisories for CVE-2026-107176 (2)
Same Patch Batch · Red Hat · 2026-10-07 · 18 CVEs total
| CVE-2026-106471 | 8.1 HIGH | Candlepin: candlepin: broken object-level authorization via verifyauthorizationfilter mult |
| CVE-2026-107161 | 7.5 HIGH | Cyrus-sasl: heap buffer overflow in cyrus-sasl add_to_challenge() allows malicious server |
| CVE-2026-103868 | 6.5 MEDIUM | Pulp-container: registry credentials are reused across remotes in a worker |
| CVE-2026-103869 | 6.5 MEDIUM | Pulp-ansible: bearer tokens are reused across remotes in a worker |
| CVE-2026-107121 | 6.5 MEDIUM | Keycloak-services: keycloak-services: smtp starttls plaintext credential and message downg |
| CVE-2026-107174 | 6.4 MEDIUM | Source-to-image: source-to-image: security boundary bypass via absolute symbolic link extr |
| CVE-2026-106067 | 6.3 MEDIUM | Gimp: gimp: heap buffer overflow in hot color filter on oversized image |
| CVE-2026-106064 | 6.3 MEDIUM | Gimp: gimp: heap buffer overflow in gif export on oversized image dimensions |
| CVE-2026-106065 | 6.3 MEDIUM | Gimp: gimp: heap buffer overflow in pcx export on oversized image dimensions |
| CVE-2026-106066 | 6.3 MEDIUM | Gimp: gimp: heap buffer overflow in raw data export on oversized image dimensions |
| CVE-2026-107168 | 6.2 MEDIUM | M17n-lib: parser infinite loop on malformed utf-8 in count_utf_8_chars() |
| CVE-2026-107167 | 6.2 MEDIUM | M17n-lib: heap use-after-free write in re_init_ic() |
| CVE-2026-107169 | 6.2 MEDIUM | M17n-lib: null-pointer write in read_mtext_element() on malformed utf-8 |
| CVE-2026-107151 | 5.9 MEDIUM | Rubygem-smart_proxy_dynflow: task update and done callbacks accept unauthenticated request |
| CVE-2026-106061 | 5.5 MEDIUM | Gimp: gimp: heap buffer over-read in x cursor (xmc) thumbnail loader on crafted file |
| CVE-2026-103870 | 5.0 MEDIUM | Pulp-rpm: distribution tree publish creates directories from .treeinfo ids |
| CVE-2026-107170 | 2.9 LOW | M17n-lib: null dereference in minput_open_im() after failed m17n_init() |
IV. Related Vulnerabilities
Same product: Red Hat OpenShift Container Platform 4
-
CVE-2026-93017
Insights-operator: gather serviceaccount has cluster-wide se -
CVE-2026-62146
Cri-o: cri-o: sandbox state poisoning via pod annotations ma -
CVE-2026-75939
Openshift/oc-mirror: release signature verification: openpgp -
CVE-2026-15801
Cri-o: cri-o: insufficient validation during container check -
CVE-2026-77176
Kata-containers: insufficient validation of createcontainer
Same vendor: Red Hat
-
CVE-2026-108063
Libhangul: null pointer dereference in hanja_new() when look -
CVE-2026-107935
Gvisor-tap-vsock: gvisor-tap-vsock: unathenticated arbitrary -
CVE-2026-107655
Cups: null pointer dereference via embedded job ticket comme -
CVE-2026-107889
Keycloak-services: keycloak-services: stored xss on login pa -
CVE-2026-107651
Eog: eog: arbitrary code execution via heap buffer overflow
Same weakness: CWE-250
-
CVE-2026-106378
Chrome Mac 权限提升漏洞（<155.0.8059.39） -
CVE-2026-66246
HCL iControl is affected by multiple security vulnerabilitie -
CVE-2026-53605
Reachy Mini Wireless: Local Privilege Escalation via Unrestr -
CVE-2026-102247
FastAdmin Database Management database.php unnecessary privi -
CVE-2026-88808
Fleet agent copies downstream resources with cluster-admin p
V. Comments for CVE-2026-107176
No comments yet