CVE-2026-107176: Execution with Unnecessary Privileges in Red Hat Red Hat OpenShift Container Platform 4

The vulnerability arises because the coreos-pull-secret-reader Role grants get, list, and watch permissions on all Secret resources in the openshift-config namespace without resourceNames scoping, whereas the operator only requires access to the pull-secret Secret. If an attacker exploits a separate vulnerability to compromise the samples-operator pod or its service account token, they could leverage this excessive privilege to read all secrets in the namespace, leading to potential exposure of sensitive cluster configuration data.

An attacker who gains control over the samples-operator pod or its service account token can access all Secret resources in the openshift-config namespace. This includes highly sensitive information such as OAuth identity provider credentials and cloud provider credentials, which could lead to further compromise of the cluster or associated cloud resources. The vulnerability does not allow privilege escalation or denial of service directly but results in confidentiality loss of critical secrets.

Patch status is not yet confirmed — check the Red Hat advisory at https://access.redhat.com/security/cve/CVE-2026-107176 for current remediation guidance. Until a fix is available, restrict access to the samples-operator pod and its service account token to trusted users only, and monitor for any suspicious activity related to this operator. Review and tighten RBAC permissions to scope access to only the necessary Secret resource (pull-secret) if possible.