CVE-2026-10840 is a vulnerability in the OpenShift Pipelines operator where the tekton-scheduler-rolebinding ClusterRoleBinding improperly grants the system:authenticated group write access to Kueue and cert-manager custom resources via the tekton-scheduler-role ClusterRole. This misconfiguration allows any authenticated user to disrupt workload scheduling, tamper with scheduling priorities, delete workload objects belonging to other tenants, or cause cert-manager to overwrite TLS Secrets including the default ingress controller certificate. The vulnerable RBAC objects are deployed regardless of whether the Tekton Scheduler feature is enabled. The issue affects Red Hat OpenShift Builds versions >=1.7.3 and <1.7.4. The recommended remediation is to upgrade to version 1.7.4 or apply a manual patch to restrict the ClusterRoleBinding to a specific ServiceAccount, though the operator's reconciliation loop may revert manual changes.

The vulnerability allows any authenticated user on the cluster to gain write privileges to critical custom resources related to workload scheduling and certificate management. This can result in disruption of workload scheduling, unauthorized modification or deletion of workloads belonging to other tenants, and overwriting of TLS secrets, potentially compromising cluster security and availability. The impact on confidentiality is rated none, integrity impact is low, and availability impact is high according to Red Hat's CVSS assessment.

Red Hat recommends upgrading Red Hat OpenShift Builds from version 1.7.3 to 1.7.4, which contains the fix for this vulnerability. If the Tekton Scheduler feature is not in use, administrators can mitigate the issue by patching the tekton-scheduler-rolebinding ClusterRoleBinding to reference a specific ServiceAccount instead of the system:authenticated group. However, manual patches may be reverted by the operator's reconciliation loop, so verify that the operator does not revert this change or disable reconciliation for this object. Alternatively, the ClusterRoleBinding can be deleted if the Tekton Scheduler is not enabled. Always consult the official Red Hat advisory for detailed instructions and updates.