https://access.redhat.com/security/cve/cve-2026-10840

[cr0w@infosec.exchange]

cve-details

(access.redhat.com)

A flaw was found in the OpenShift Pipelines operator. The tekton-scheduler-rolebinding ClusterRoleBinding grants the system:authenticated group write access to Kueue and cert-manager custom resources via the tekton-scheduler-role ClusterRole. When Kueue or cert-manager CRDs are present on the cluster, any authenticated user can disrupt workload scheduling, tamper with scheduling priorities, delete other tenants' Workload objects, or induce cert-manager to overwrite TLS Secrets including the default ingress controller certificate.

[wdormann@infosec.exchange]

@cR0w
https://www.youtube.com/watch?v=aW2LvQUcwqc

[cr0w@infosec.exchange]

@wdormann I don't have YouTube but searching the link looks like the Rockwell Retroencabulator video?

[jackryder@infosec.exchange]

@cR0w @wdormann It's a video of a guy talking a bunch of science stuff.

The fictional Retro Encabulator device, which uses six hydrocoptic marzel vanes and an ambifacient lunar wane shaft to prevent unwanted side fumbling. We can't believe the salesman was able to keep a straight face.

[cr0w@infosec.exchange]

@jackryder @wdormann Ah. Yeah, that one's a classic.

[jackryder@infosec.exchange]

@cR0w @wdormann He looks like Chris Hansen from an alternative timeline where he went "Sales guy" instead of "Have a seat..."

[cr0w@infosec.exchange]

@jackryder @wdormann They're the same picture.

[jackryder@infosec.exchange]

@cR0w @wdormann it's creepy!
Like, are we sure it isn't Chris?

watches for the 8millionth time

[wdormann@infosec.exchange]

@cR0w
"Don't have YouTube"...
YouTube is a website?

[cr0w@infosec.exchange]

@wdormann Sorry, I mean it's blocked on my network. Intentionally.

[ajn142@infosec.exchange]

@wdormann @cR0w I assume they mean it's blocked on their network?

[cr0w@infosec.exchange]

@wdormann Unlike Reddit who blocks me.

[cr0w@infosec.exchange]

@wdormann

[zackwhittaker@mastodon.social]

@wdormann @cR0w if you haven't seen the Rick & Morty "plumbus" video, it has a similar vibe. always cracks me up.

[fritzadalis@infosec.exchange]

@wdormann @cR0w
I mean I tell people I don't have a phone... when I'm standing in front of them looking at my phone.

[wdormann@infosec.exchange]

@FritzAdalis @cR0w

[tindrasgrove@infosec.exchange]

@wdormann @cR0w I need to add this to my onboarding document

[spartan_1986@infosec.exchange]

@cR0w JFC I work in IT and that paragraph still reads like something out of a James Bondage tech-bromance satire.

[cr0w@infosec.exchange]

@Spartan_1986 It's so bad.