{"affected":[{"defaultStatus":"affected","ecosystem":"https://catalog.redhat.com/software/containers/","packageName":"openshift4/ose-cluster-samples-rhel9-operator","product":"Red Hat OpenShift Container Platform 4.19","source":"CNA: redhat","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1793123280","versionType":"rpm"}]},{"defaultStatus":"affected","ecosystem":"https://catalog.redhat.com/software/containers/","packageName":"openshift4/ose-cluster-samples-rhel9-operator","product":"Red Hat OpenShift Container Platform 4.20","source":"CNA: redhat","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1792826398","versionType":"rpm"}]},{"defaultStatus":"affected","ecosystem":"https://catalog.redhat.com/software/containers/","packageName":"openshift4/ose-cluster-samples-rhel9-operator","product":"Red Hat OpenShift Container Platform 4.21","source":"CNA: redhat","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1792852494","versionType":"rpm"}]},{"defaultStatus":"affected","ecosystem":"https://catalog.redhat.com/software/containers/","packageName":"openshift4/ose-cluster-samples-rhel9-operator","product":"Red Hat OpenShift Container Platform 4.22","source":"CNA: redhat","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1792770602","versionType":"rpm"}]},{"defaultStatus":"affected","ecosystem":"https://access.redhat.com/downloads/content/package-browser/","packageName":"openshift4/ose-cluster-samples-operator","product":"Red Hat OpenShift Container Platform 4","source":"CNA: redhat","vendor":"Red Hat","versions":[]},{"defaultStatus":"affected","ecosystem":"https://access.redhat.com/downloads/content/package-browser/","packageName":"openshift5/ose-cluster-samples-rhel9-operator","product":"Red Hat OpenShift Container Platform 5","source":"CNA: redhat","vendor":"Red Hat","versions":[]}],"cveId":"CVE-2026-107176","cwes":["CWE-250"],"description":"A flaw was found in the cluster-samples-operator. The RBAC Role coreos-pull-secret-reader in namespace openshift-config grants get, list, and watch permissions on all Secret resources without resourceNames scoping. The operator only requires access to the pull-secret Secret. If the samples-operator pod or its service account token is compromised through a separate vulnerability, an attacker could read all secrets in openshift-config, potentially including OAuth identity provider credentials, cloud provider credentials, and other sensitive cluster configuration.","epss":{"date":"2026-11-04","percentile":0.18981,"score":0.00267},"exploits":[],"kev":null,"metrics":[{"score":6.8,"severity":"medium","source":"CNA: redhat","vector":"CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N","version":"3.1"},{"score":6.8,"severity":"medium","source":"NVD: secalert@redhat.com","vector":"CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N","version":"3.1"}],"modifiedAt":1793809052813,"publishedAt":1791401371293,"references":[{"source":"CNA: redhat","tags":["vendor-advisory","x_refsource_REDHAT"],"url":"https://access.redhat.com/errata/RHSA-2026:89198"},{"source":"CNA: redhat","tags":["vendor-advisory","x_refsource_REDHAT"],"url":"https://access.redhat.com/errata/RHSA-2026:89341"},{"source":"CNA: redhat","tags":["vendor-advisory","x_refsource_REDHAT"],"url":"https://access.redhat.com/errata/RHSA-2026:89626"},{"source":"CNA: redhat","tags":["vendor-advisory","x_refsource_REDHAT"],"url":"https://access.redhat.com/errata/RHSA-2026:92280"},{"source":"CNA: redhat","tags":["vdb-entry","x_refsource_REDHAT"],"url":"https://access.redhat.com/security/cve/CVE-2026-107176"},{"source":"CNA: redhat","tags":["issue-tracking","x_refsource_REDHAT"],"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2523035"},{"source":"secalert@redhat.com","tags":[],"url":"https://access.redhat.com/errata/RHSA-2026:89198"},{"source":"secalert@redhat.com","tags":[],"url":"https://access.redhat.com/errata/RHSA-2026:89341"},{"source":"secalert@redhat.com","tags":[],"url":"https://access.redhat.com/errata/RHSA-2026:89626"},{"source":"secalert@redhat.com","tags":[],"url":"https://access.redhat.com/errata/RHSA-2026:92280"},{"source":"secalert@redhat.com","tags":[],"url":"https://access.redhat.com/security/cve/CVE-2026-107176"},{"source":"secalert@redhat.com","tags":[],"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2523035"}],"remediation":[{"kind":"workaround","source":"CNA: redhat","text":"Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."}],"revision":"7ddfd0641c07b3d329dc129a31457f7b3b9ec799ec4b3be32d45776ab302435d","sources":[{"modifiedAt":1793807828405,"name":"CNA: redhat","retrievedAt":1793808519791,"url":"https://www.cve.org/CVERecord?id=CVE-2026-107176"},{"modifiedAt":1793809052813,"name":"NVD","retrievedAt":1793816190728,"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107176"},{"modifiedAt":null,"name":"FIRST EPSS","retrievedAt":1793808540635,"url":"https://api.first.org/data/v1/epss?cve=CVE-2026-107176"}],"ssvc":{"assessedAt":1791403143424,"automatable":"no","exploitation":"none","source":"ADP: CISA-ADP","technicalImpact":"partial"},"status":"published","title":"Cluster-samples-operator: role reads all secrets in openshift-config, not just pull-secret","updatedAt":1793816190728}