A vulnerability in the cluster-samples-operator of Red Hat OpenShift Container Platform allows excessive permissions via the RBAC Role coreos-pull-secret-reader in the openshift-config namespace. This role grants get, list, and watch permissions on all Secret resources without restricting to specific resourceNames, while the operator only needs access to the pull-secret Secret. If the samples-operator pod or its service account token is compromised, an attacker could read all secrets in the namespace, potentially exposing sensitive credentials and cluster configuration. Red Hat has released OpenShift Container Platform 4.22.20 with a security update addressing this issue.