CVE-2026-10843: Cloud-credential-operator: cco mint-mode credentialsrequest manifests grant account-wide iam access beyond cluster scope on aws
A flaw was found in the Cloud Credential Operator (CCO) Mint-mode CredentialsRequest manifests shipped with OpenShift Container Platform for AWS. The CredentialsRequest specifications for the Image Registry, Machine API, Ingress Operator, and EBS CSI Driver request IAM policies with Resource: "" for destructive actions (S3 CreateBucket/DeleteBucket/PutObject/DeleteObject, EC2 TerminateInstances/RunInstances, Route53 ChangeResourceRecordSets, EC2 DeleteVolume/DeleteSnapshot). This grants the provisioned operator IAM credentials access to any AWS resource in the account, not just resources owned by the cluster. An attacker who obtains these credentials (via pod compromise, RBAC escalation, or Secret read) can perform destructive operations against unrelated AWS resources in the same account, including deleting S3 buckets, terminating EC2 instances, modifying DNS records in unrelated hosted zones, and deleting EBS volumes belonging to other workloads or clusters.
Other sources
A flaw was found in the OpenShift Cloud Credential Operator Mint-mode IAM policies for AWS. Operator credentials are provisioned with account-wide scope for destructive actions rather than being restricted to cluster-owned resources, enabling cross-scope impact after credential compromise.
— MITRE
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-10843?
The severity of CVE-2026-10843 is rated as high with a score of 7.2.
What are the main concerns related to CVE-2026-10843?
CVE-2026-10843 allows account-wide IAM access on AWS due to excessively permissive IAM policies defined in the CredentialsRequest manifests.
How do I fix CVE-2026-10843?
To fix CVE-2026-10843, review and restrict the IAM policies in the CredentialsRequest manifests to ensure they do not use Resource: '*'.
Which components are affected by CVE-2026-10843?
CVE-2026-10843 impacts the Image Registry, Machine API, Ingress Operator, and EBS CSI Driver configurations in OpenShift Container Platform.
What should I do if I am using Red Hat OpenShift Container Platform?
If you are using Red Hat OpenShift Container Platform, it is recommended to assess your use of the Cloud Credential Operator and implement the necessary IAM policy restrictions.