VULNERABILITY INTELLIGENCE
CVE-2026-10843
CVSS score7.2 HIGH
EPSS probability0.33%
CISA KEVNot currently listed
Published2026-06-04
Last modified2026-10-30
CVSS vectorCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Description
A flaw was found in the OpenShift Cloud Credential Operator Mint-mode IAM policies for AWS. Operator credentials are provisioned with account-wide scope for destructive actions rather than being restricted to cluster-owned resources, enabling cross-scope impact after credential compromise.
Weakness classification
- secalert@redhat.com: CWE-250
- 0b0ca135-0b70-47e7-9f44-1890c2a1c46c: CWE-250