CVE-2026-10533: Openshift: openshift: non-admin user can bypass resourcequota and flood etcd with events causing cluster-wide api degradation

The OpenShift Container Platform ResourceQuota controller does not count completed pods (restartPolicy: Never, phase Succeeded) against the pod quota. Additionally, Kubernetes events generated by pod lifecycle operations are not subject to any quota or rate limit. A non-admin user with pod creation privileges can deploy a control pod using the default deployer ServiceAccount that continuously spawns short-lived child pods (150ms sleep, then complete). Each child pod generates events, frees its quota slot on completion, and allows the next pod to be created. In testing, a single control pod generates approximately 43,000 events per hour. With a 3-hour event TTL, this produces ~130,000 events from a single namespace, which is sufficient to cause etcd pressure and API server degradation. The attack requires only the ability to deploy a pod — no elevated privileges, quota changes, or cross-namespace access. An administrator can remediate by deleting events and completed pods, and events expire naturally via the 3-hour TTL.

— Red Hat