The vulnerability CVE-2026-10843 affects the OpenShift Cloud Credential Operator in Red Hat OpenShift Container Platform 4. The issue is that the Mint-mode IAM policies for AWS provision operator credentials with account-wide scope rather than restricting them to cluster-owned resources. This excessive privilege assignment (CWE-250) enables an attacker who compromises these credentials to perform destructive actions across the AWS account, not limited to the cluster resources. The CVSS 3.1 score is 7.2 (high severity) with network attack vector, low attack complexity, high privileges required, no user interaction, unchanged scope, and high impact on confidentiality, integrity, and availability. Red Hat provides a patch and manages remediation for this cloud-hosted service. The vendor advisory is available at https://access.redhat.com/security/cve/CVE-2026-10843.

If exploited, this vulnerability allows an attacker with compromised operator credentials to perform destructive actions across the entire AWS account, not just within the cluster-owned resources. This can lead to significant confidentiality, integrity, and availability impacts on the cloud environment managed by OpenShift. The scope of impact extends beyond the intended resource boundaries due to excessive privileges granted by the IAM policies.

A patch is available for this vulnerability. Since Red Hat OpenShift Container Platform 4 is a cloud service, Red Hat manages remediation server-side. Users should consult the official Red Hat advisory at https://access.redhat.com/security/cve/CVE-2026-10843 for detailed patching and mitigation instructions and ensure their environments are updated accordingly.