This vulnerability involves excessive privilege assignment in the OpenShift Cloud Credential Operator's Mint-mode IAM policies for AWS within Red Hat OpenShift Container Platform 4. Specifically, operator credentials are provisioned with account-wide scope rather than being restricted to cluster-owned resources. This misconfiguration allows for cross-scope impact if the credentials are compromised, potentially enabling destructive actions beyond the intended resource boundaries. The CVSS 3.1 base score is 7.2, indicating high severity. The affected product is a cloud-hosted service, and Red Hat provides a patch to address this issue. No known active exploitation has been reported.

If exploited, this vulnerability allows an attacker who compromises the operator credentials to perform destructive actions across the entire AWS account, not limited to cluster-owned resources. This broad scope can lead to significant confidentiality, integrity, and availability impacts on AWS resources managed under the compromised account. However, there are no known exploits in the wild currently.

Red Hat manages remediation for this vulnerability as it affects a cloud-hosted service. A patch is available, and users should apply the official fix provided by Red Hat as detailed in their advisory at https://access.redhat.com/security/cve/CVE-2026-10843. Until patched, organizations should review and restrict IAM policies to limit credential scope where possible. Monitor Red Hat's advisory for updates and apply patches promptly.