{"id":"CVE-2026-107176","aliases":[],"cve":{"records":[{"id":"CVE-2026-107176","source":"redhat","state":"PUBLISHED","reasons":[],"replacements":[],"disputed":false,"unsupportedWhenAssigned":false,"reserved":"2026-10-07T12:39:11.178Z","published":"2026-10-07T19:29:31.293Z","modified":"2026-11-04T15:57:08.405Z"}],"publishers":[{"name":"redhat","role":"CNA","organizationId":"53f830b8-0a3f-465b-8143-3b8a9948e749","modified":"2026-11-04T15:57:08.405Z"},{"name":"CISA-ADP","role":"ADP","organizationId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","modified":"2026-10-07T19:59:13.232Z"}],"references":[{"url":"https://access.redhat.com/errata/RHSA-2026:89198","tags":["vendor-advisory","x_refsource_REDHAT"],"source":"redhat"},{"url":"https://access.redhat.com/errata/RHSA-2026:89341","tags":["vendor-advisory","x_refsource_REDHAT"],"source":"redhat"},{"url":"https://access.redhat.com/errata/RHSA-2026:89626","tags":["vendor-advisory","x_refsource_REDHAT"],"source":"redhat"},{"url":"https://access.redhat.com/errata/RHSA-2026:92280","tags":["vendor-advisory","x_refsource_REDHAT"],"source":"redhat"},{"url":"https://access.redhat.com/security/cve/CVE-2026-107176","tags":["vdb-entry","x_refsource_REDHAT"],"source":"redhat"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2523035","tags":["issue-tracking","x_refsource_REDHAT"],"source":"redhat"}],"weaknesses":[{"id":"CWE-250","description":"Execution with Unnecessary Privileges","source":"redhat"}],"applicability":[],"prioritization":[{"source":"CISA-ADP","type":"SSVC","role":"CISA Coordinator","timestamp":"2026-10-07T19:59:03.424144Z","decisions":[{"name":"Exploitation","value":"none"},{"name":"Automatable","value":"no"},{"name":"Technical Impact","value":"partial"}]}]},"title":"Cluster-samples-operator: role reads all secrets in openshift-config, not just pull-secret","titleSource":"redhat","descriptionSource":"redhat","description":"A flaw was found in the cluster-samples-operator. The RBAC Role coreos-pull-secret-reader in namespace openshift-config grants get, list, and watch permissions on all Secret resources without resourceNames scoping. The operator only requires access to the pull-secret Secret. If the samples-operator pod or its service account token is compromised through a separate vulnerability, an attacker could read all secrets in openshift-config, potentially including OAuth identity provider credentials, cloud provider credentials, and other sensitive cluster configuration.","score":6.8,"severity":"medium","published":"2026-10-07T19:29:31.293Z","modified":"2026-11-04T15:57:08.405Z","withdrawn":false,"knownExploited":false,"affected":[],"products":[{"vendor":"Red Hat","name":"Red Hat OpenShift Container Platform 4.19","platforms":[],"versions":[{"version":"1793123280","status":"unaffected","lessThan":"*","versionType":"rpm"}],"defaultStatus":"affected","cpes":["cpe:/a:redhat:openshift:4.19::el9"],"source":"redhat","url":"https://www.cve.org/CVERecord?id=CVE-2026-107176"},{"vendor":"Red Hat","name":"Red Hat OpenShift Container Platform 4.20","platforms":[],"versions":[{"version":"1792826398","status":"unaffected","lessThan":"*","versionType":"rpm"}],"defaultStatus":"affected","cpes":["cpe:/a:redhat:openshift:4.20::el9"],"source":"redhat","url":"https://www.cve.org/CVERecord?id=CVE-2026-107176"},{"vendor":"Red Hat","name":"Red Hat OpenShift Container Platform 4.21","platforms":[],"versions":[{"version":"1792852494","status":"unaffected","lessThan":"*","versionType":"rpm"}],"defaultStatus":"affected","cpes":["cpe:/a:redhat:openshift:4.21::el9"],"source":"redhat","url":"https://www.cve.org/CVERecord?id=CVE-2026-107176"},{"vendor":"Red Hat","name":"Red Hat OpenShift Container Platform 4.22","platforms":[],"versions":[{"version":"1792770602","status":"unaffected","lessThan":"*","versionType":"rpm"}],"defaultStatus":"affected","cpes":["cpe:/a:redhat:openshift:4.22::el9"],"source":"redhat","url":"https://www.cve.org/CVERecord?id=CVE-2026-107176"},{"vendor":"Red Hat","name":"Red Hat OpenShift Container Platform 4","platforms":[],"versions":[],"defaultStatus":"affected","cpes":["cpe:/a:redhat:openshift:4"],"source":"redhat","url":"https://www.cve.org/CVERecord?id=CVE-2026-107176"},{"vendor":"Red Hat","name":"Red Hat OpenShift Container Platform 5","platforms":[],"versions":[],"defaultStatus":"affected","cpes":["cpe:/a:redhat:openshift:5"],"source":"redhat","url":"https://www.cve.org/CVERecord?id=CVE-2026-107176"}],"remediation":[{"text":"Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.","source":"redhat","url":"https://www.cve.org/CVERecord?id=CVE-2026-107176"}],"references":["https://access.redhat.com/errata/RHSA-2026:89198","https://access.redhat.com/errata/RHSA-2026:89341","https://access.redhat.com/errata/RHSA-2026:89626","https://access.redhat.com/errata/RHSA-2026:92280","https://access.redhat.com/security/cve/CVE-2026-107176","https://bugzilla.redhat.com/show_bug.cgi?id=2523035"],"sources":[{"name":"CVE","id":"CVE-2026-107176","modified":"2026-11-04T15:57:08.405Z","url":"https://www.cve.org/CVERecord?id=CVE-2026-107176"}],"assessments":[{"source":"redhat","vector":"CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N","score":6.8}],"sourceAffected":[],"observedAt":"2026-11-04T17:13:03.705Z","kev":{"status":"not-listed","checkedAt":"2026-11-15T03:00:33.317Z"},"coverage":[{"source":"NVD","status":"available","checkedAt":"2026-10-30T01:25:34.547Z","attemptedAt":"2026-10-30T01:25:34.547Z"},{"source":"GHSA","status":"available","checkedAt":"2026-10-30T01:25:33.479Z","attemptedAt":"2026-10-30T01:25:33.479Z"},{"source":"EUVD","status":"available","checkedAt":"2026-10-30T01:25:33.275Z","attemptedAt":"2026-10-30T01:25:33.275Z"},{"source":"EPSS","status":"available","checkedAt":"2026-10-30T01:25:33.349Z","attemptedAt":"2026-10-30T01:25:33.349Z"}],"evidence":[{"source":"ENISA EUVD","id":"EUVD-2026-94581","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-94581","modified":"Oct 29, 2026, 9:06:30 PM","score":6.8,"vector":"CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N","checkedAt":"2026-10-30T01:25:33.275Z"},{"source":"FIRST EPSS","id":"CVE-2026-107176","url":"https://www.first.org/epss/","probability":0.00164,"percentile":0.05623,"date":"2026-10-29","checkedAt":"2026-10-30T01:25:33.349Z"},{"source":"GitHub Advisory Database","id":"GHSA-f5p7-fm92-q7hr","url":"https://github.com/advisories/GHSA-f5p7-fm92-q7hr","modified":"2026-10-30T00:31:37Z","score":6.8,"vector":"CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N","checkedAt":"2026-10-30T01:25:33.479Z"},{"source":"NVD","id":"CVE-2026-107176","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107176","modified":"2026-10-29T22:17:00.473","score":6.8,"vector":"CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N","checkedAt":"2026-10-30T01:25:34.547Z"}],"aiSummary":{"text":"A flaw in the cluster-samples-operator allows the coreos-pull-secret-reader role to read all secrets in openshift-config. An attacker with access to the samples-operator pod or its service account token could read sensitive cluster configuration. The affected product is Red Hat OpenShift Container Platform.","model":"@cf/meta/llama-3.3-70b-instruct-fp8-fast","generatedAt":"2026-11-04T17:16:10.019Z","sources":[{"name":"CVE","url":"https://www.cve.org/CVERecord?id=CVE-2026-107176"}]}}