CVE-2026-15140: CWE-266 Incorrect privilege assignment in Everpure Portworx Operator
Affects Everpure Portworx OperatorSource CVE Database V5
- Exploitation
Not in CISA KEV, no exploitation reported
- EPSS
- 0.2% chance of exploitation in 30 days – higher than 10% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.
CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:NWhat to do
Affected software
| Product | Affected | Fixed in |
|---|---|---|
| EverpurePortworx Operator | Affected
| Fixed in– |
AI-suggested
Users should monitor vendor communications for updates and consider restricting initial provisioning access to trusted users only until a fix is available.
Description
A privilege-escalation issue in the Portworx Operator when deployed on Red Hat OpenShift (OCP). Only under specific conditions during the initial provisioning of a Portworx storage cluster, a user holding only limited, namespace-scoped permissions could cause the operator to grant broader access than intended, potentially resulting in elevated privileges within the Kubernetes cluster.
Impact
The vulnerability allows a user with limited namespace-scoped permissions to escalate privileges within the Kubernetes cluster by causing the Portworx Operator to assign broader access than intended. This could lead to unauthorized actions or control over cluster resources beyond the user's original permissions.
Summary
This vulnerability involves incorrect privilege assignment (CWE-266) in the Portworx Operator by Everpure. When deployed on Red Hat OpenShift, during the initial provisioning phase of a Portworx storage cluster, a user with limited, namespace-scoped permissions can exploit this flaw to cause the operator to grant broader permissions than intended. This results in privilege escalation within the Kubernetes cluster environment. The CVSS 4.0 base score is 7.7, indicating a high severity with network attack vector, low attack complexity, and partial privileges required. No official remediation or patch information is currently available.