Description
A flaw was found in the OpenShift Pipelines operator. The tekton-scheduler-rolebinding ClusterRoleBinding grants the system:authenticated group write access to Kueue and cert-manager custom resources via the tekton-scheduler-role ClusterRole. When Kueue or cert-manager CRDs are present on the cluster, any authenticated user can disrupt workload scheduling, tamper with scheduling priorities, delete other tenants' Workload objects, or induce cert-manager to overwrite TLS Secrets including the default ingress controller certificate.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
Red Hat Red Hat OpenShift Builds 1.7.3
Default version status: affected
1783341609 to < *unaffected
Red Hat Red Hat OpenShift Builds 1.8.1
Default version status: affected
1784121108 to < *unaffected
Red Hat OpenShift Pipelines
Default version status: unaffected
Red Hat OpenShift Pipelines
Default version status: affected
Red Hat OpenShift Pipelines
Default version status: affected
Red Hat OpenShift Pipelines
Default version status: affected
Red Hat OpenShift Pipelines
Default version status: unaffected
Red Hat OpenShift Pipelines
Default version status: affected