OpenShift ClusterRole blows wide open, Cisco UCM goes from SSRF to root

The OpenShift Pipelines operator binds a ClusterRole with write access to Kueue and cert-manager custom resources to the system:authenticated group. That means any authenticated cluster user can mess with workload scheduling, delete other tenants' Workload objects, or trick cert-manager into overwriting TLS secrets, including the default ingress certificate. This is a CVSS 9.6 privilege escalation that requires only basic cluster authentication.

Affected estate

OpenShift cluster operators using the OpenShift Pipelines operator where Kueue or cert-manager CRDs are installed

How to check

Run: kubectl get clusterrolebinding tekton-scheduler-rolebinding -o yaml. If 'subjects' includes 'system:authenticated', you're exposed.

Included because

authenticated access only; cluster-wide impact; CVSS 9.6; affects shared infrastructure component

Action

Update the OpenShift Pipelines operator to the fixed release. As a stopgap, remove or scope down the tekton-scheduler-rolebinding ClusterRoleBinding.

Why it matters

Any authenticated user can overwrite TLS secrets or disrupt scheduling across the entire cluster, breaking ingress and cross-tenant isolation.

Source

Red Hat Security Advisory

A use-after-free race condition exists in OP-TEE's shared memory teardown logic for FF-A secure partitions. An attacker who can trigger concurrent shared memory operations could exploit this to corrupt memory in the secure world. This only applies if you've built OP-TEE as an SPMC for S-EL0 secure partitions (CFG_SECURE_PARTITION=y), which is not a default config.

Affected estate

Embedded and IoT teams running OP-TEE versions 3.16.0 through 4.10.x with CFG_SECURE_PARTITION=y on Arm TrustZone hardware

How to check

Check your OP-TEE build config for CFG_SECURE_PARTITION=y and verify the OP-TEE version string in your firmware build manifest or boot log.

Included because

secure world memory corruption; specific non-default configuration required; CVSS 7.8

Action

Update OP-TEE to 4.11.0. If you cannot update immediately, confirm CFG_SECURE_PARTITION is not enabled in your build.

Why it matters

Memory corruption in the secure world can undermine the entire TrustZone trust boundary, potentially exposing secrets or enabling code execution in secure context.

Source

OP-TEE GitHub Advisory

The OpenShift Cloud Credential Operator in Mint mode provisions AWS IAM credentials with account-wide destructive permissions instead of scoping them to cluster-owned resources. If an attacker compromises those credentials, they can delete or modify AWS resources outside the cluster, affecting other workloads in the same AWS account.

Affected estate

OpenShift operators running on AWS in Mint credential mode

How to check

Run: oc get cloudcredential cluster -o jsonpath='{.spec.credentialsMode}'. If it returns 'Mint' or is empty (defaulting to Mint), you're affected. Then review the IAM policies attached to the operator's provisioned roles in your AWS console.

Included because

credential compromise leads to cross-scope AWS impact; CVSS 7.2; common cloud deployment pattern

Action

Update the Cloud Credential Operator. Audit and restrict the IAM policies it created to cluster-scoped resources only.

Why it matters

Compromised cluster credentials could destroy or modify AWS resources across the entire account, not just the cluster.

Source

Red Hat Security Advisory

The CRMEB Java e-commerce platform (version 1.4) has an SSRF bug in its QR code endpoint. An attacker can manipulate the URL parameter to make the server send arbitrary HTTP requests on their behalf, potentially reaching internal services. A public exploit already exists.

Affected estate

Anyone running CRMEB Java (crmeb_java) version 1.4

How to check

Check your CRMEB deployment version and confirm whether the QR code endpoint (RestTemplateUtil.getForEntity) is publicly accessible.

Included because

remotely exploitable; public exploit available; SSRF to internal network; no vendor response yet

Action

Block or restrict external access to the affected endpoint. Apply URL allowlisting at the application or WAF level until an official patch is released.

Why it matters

Public exploit code exists. SSRF lets attackers probe and reach internal services from your server, potentially pivoting further into your network.