The vulnerability CVE-2026-10840 affects Red Hat OpenShift Builds 1.7.3 due to incorrect permission assignment in the tekton-scheduler-rolebinding ClusterRoleBinding. Specifically, the system:authenticated group is granted write access to Kueue and cert-manager custom resources via the tekton-scheduler-role ClusterRole. When Kueue or cert-manager CRDs are present, this allows any authenticated user to interfere with workload scheduling, modify scheduling priorities, delete workloads belonging to other tenants, or cause cert-manager to overwrite critical TLS secrets including the default ingress controller certificate. Red Hat has issued a security advisory recommending upgrading to version 1.7.4, which addresses this permission misconfiguration. The CVSS 3.1 vector indicates network attack vector, low attack complexity, low privileges required, no user interaction, unchanged scope, no confidentiality impact, low integrity impact, and high availability impact.

Exploitation of this vulnerability allows any authenticated user on the cluster to perform unauthorized write operations on critical custom resources related to workload scheduling and TLS secrets. This can lead to disruption of workload scheduling, unauthorized deletion of workloads belonging to other tenants, tampering with scheduling priorities, and overwriting of TLS secrets including the default ingress controller certificate. The impact is primarily on integrity and availability of the cluster workloads and security credentials, potentially causing denial of service or security breaches related to TLS certificates.

Red Hat has released OpenShift Builds version 1.7.4 which fixes this vulnerability. It is strongly recommended that users running version 1.7.3 upgrade to 1.7.4 to remediate the incorrect permission assignment. No other temporary mitigations are indicated in the advisory. Users should follow the official Red Hat advisory RHSA-2026:36648 for upgrade instructions and verify that the cluster is updated accordingly.