CVE-2026-10843CWE-250

Cloud-credential-operator: cco mint-mode credentialsrequest manifests grant account-wide iam access beyond cluster scope on aws

High · published June 4, 2026

CVSS v3.1
7.2
EPSS
0%
Percentile
24.6
In the wild
Unconfirmed
What it is

A flaw was found in the OpenShift Cloud Credential Operator Mint-mode IAM policies for AWS. Operator credentials are provisioned with account-wide scope for destructive actions rather than being restricted to cluster-owned resources, enabling cross-scope impact after credential compromise.

The record
Technical detail
CVSS v3.1
7.2 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00328 · 24.6th percentile
Weakness
CWE-250 · Execution with Unnecessary Privileges
Published
2026-06-04T12:04Z
EPSS history
Timeline
  • 04 JUN 12:04Z
    Cloud-credential-operator: cco mint-mode credentialsrequest manifests grant account-wide iam access beyond cluster scope on aws
    cvelistv5