The vulnerability CVE-2026-10840 affects Red Hat OpenShift Builds version 1.7.3. It arises from an incorrect permission assignment in the OpenShift Pipelines operator where the tekton-scheduler-rolebinding ClusterRoleBinding grants write access to the system:authenticated group for Kueue and cert-manager custom resources via the tekton-scheduler-role ClusterRole. When Kueue or cert-manager CRDs are present, any authenticated user can exploit this to disrupt workload scheduling, manipulate scheduling priorities, delete other tenants' Workload objects, or induce cert-manager to overwrite TLS Secrets, including the default ingress controller certificate. Red Hat has issued advisories RHSA-2026:36648 and RHSA-2026:41036 recommending upgrades to OpenShift Builds 1.7.4 and 1.8.1 respectively, which address this and other vulnerabilities.

The vulnerability allows any authenticated user on the cluster to gain unauthorized write access to critical custom resources (Kueue and cert-manager). This can lead to disruption of workload scheduling, unauthorized modification or deletion of other tenants' workloads, and overwriting of TLS Secrets, potentially impacting the security and availability of services relying on these certificates. The CVSS v3.1 score is 7.1 (High), reflecting the significant impact on integrity and availability with network attack vector and low attack complexity.

Red Hat has released fixed versions OpenShift Builds 1.7.4 and 1.8.1 that address this vulnerability. It is strongly recommended that users running version 1.7.3 upgrade to 1.7.4 or later to remediate the issue. No other temporary mitigations or workarounds are indicated in the vendor advisories. Patch status is confirmed as fixed in these newer versions.