A flaw was found in the OpenShift Pipelines operator

#!/usr/bin/env bash
# check_cve_2026_10840.sh
# Heuristic check for overprivileged OpenShift Pipelines service-account bindings.
# Outputs: VULNERABLE / PATCHED / UNKNOWN
# Exit codes: 0=PATCHED, 1=VULNERABLE, 2=UNKNOWN

set -u

if ! command -v oc >/dev/null 2>&1; then
  echo "UNKNOWN: oc CLI not found"
  exit 2
fi

if ! oc whoami >/dev/null 2>&1; then
  echo "UNKNOWN: not logged into an OpenShift cluster"
  exit 2
fi

if ! oc get ns >/dev/null 2>&1; then
  echo "UNKNOWN: insufficient privileges to query namespaces"
  exit 2
fi

found_pipeline_sa=0
vuln=0
unknown=0
notes=""

is_dangerous_clusterrole() {
  local cr="$1"
  case "$cr" in
    cluster-admin|admin|edit)
      return 0
      ;;
    *)
      return 1
      ;;
  esac
}

check_role_rules() {
  local kind="$1"
  local name="$2"
  local ns="$3"
  local jsonpath='{range .rules[*]}{.verbs}{"|"}{.resources}{"\n"}{end}'
  local out

  if [[ "$kind" == "Role" ]]; then
    out=$(oc -n "$ns" get role "$name" -o jsonpath="$jsonpath" 2>/dev/null) || return 2
  else
    out=$(oc get clusterrole "$name" -o jsonpath="$jsonpath" 2>/dev/null) || return 2
  fi

  while IFS= read -r line; do
    [[ -z "$line" ]] && continue
    verbs="${line%%|*}"
    resources="${line#*|}"
    if [[ "$verbs" == *"*"* ]] || [[ "$resources" == *"*"* ]]; then
      return 0
    fi
    if [[ "$resources" == *"secrets"* && ( "$verbs" == *"create"* || "$verbs" == *"update"* || "$verbs" == *"patch"* || "$verbs" == *"delete"* ) ]]; then
      return 0
    fi
    if [[ "$resources" == *"roles"* || "$resources" == *"rolebindings"* || "$resources" == *"clusterroles"* || "$resources" == *"clusterrolebindings"* ]]; then
      if [[ "$verbs" == *"create"* || "$verbs" == *"update"* || "$verbs" == *"patch"* || "$verbs" == *"delete"* || "$verbs" == *"bind"* || "$verbs" == *"escalate"* ]]; then
        return 0
      fi
    fi
  done <<< "$out"

  return 1
}

for ns in $(oc get sa -A --no-headers 2>/dev/null | awk '$2=="pipeline" {print $1}'); do
  found_pipeline_sa=1

  # Namespace RoleBindings
  while IFS='|' read -r rb_name role_ref_kind role_ref_name; do
    [[ -z "$rb_name" ]] && continue
    if [[ "$role_ref_kind" == "ClusterRole" ]] && is_dangerous_clusterrole "$role_ref_name"; then
      vuln=1
      notes+="namespace/$ns rolebinding/$rb_name -> dangerous clusterrole $role_ref_name; "
      continue
    fi
    if check_role_rules "$role_ref_kind" "$role_ref_name" "$ns"; then
      vuln=1
      notes+="namespace/$ns rolebinding/$rb_name -> overbroad $role_ref_kind/$role_ref_name; "
    else
      rc=$?
      if [[ $rc -eq 2 ]]; then
        unknown=1
      fi
    fi
  done < <(oc -n "$ns" get rolebinding -o jsonpath='{range .items[?(@.subjects)]}{.metadata.name}{"|"}{.roleRef.kind}{"|"}{.roleRef.name}{"\n"}{end}' 2>/dev/null | while IFS='|' read -r name kind ref; do
      if oc -n "$ns" get rolebinding "$name" -o jsonpath='{range .subjects[*]}{.kind}{"|"}{.namespace}{"|"}{.name}{"\n"}{end}' 2>/dev/null | grep -q '^ServiceAccount|'"$ns"'|pipeline$'; then
        echo "$name|$kind|$ref"
      fi
    done)

done

# ClusterRoleBindings that reference any pipeline service account
while IFS='|' read -r crb_name cr_name subject_ns; do
  [[ -z "$crb_name" ]] && continue
  found_pipeline_sa=1
  if is_dangerous_clusterrole "$cr_name"; then
    vuln=1
    notes+="clusterrolebinding/$crb_name -> dangerous clusterrole $cr_name for pipeline SA in $subject_ns; "
    continue
  fi
  if check_role_rules "ClusterRole" "$cr_name" "$subject_ns"; then
    vuln=1
    notes+="clusterrolebinding/$crb_name -> overbroad clusterrole/$cr_name for pipeline SA in $subject_ns; "
  else
    rc=$?
    if [[ $rc -eq 2 ]]; then
      unknown=1
    fi
  fi
done < <(oc get clusterrolebinding -o jsonpath='{range .items[?(@.subjects)]}{.metadata.name}{"|"}{.roleRef.name}{"\n"}{end}' 2>/dev/null | while IFS='|' read -r name ref; do
  matches=$(oc get clusterrolebinding "$name" -o jsonpath='{range .subjects[*]}{.kind}{"|"}{.namespace}{"|"}{.name}{"\n"}{end}' 2>/dev/null | awk -F'|' '$1=="ServiceAccount" && $3=="pipeline" {print $2}')
  if [[ -n "$matches" ]]; then
    while IFS= read -r m; do
      echo "$name|$ref|$m"
    done <<< "$matches"
  fi
done)

if [[ $found_pipeline_sa -eq 0 ]]; then
  echo "UNKNOWN: no pipeline service accounts found; OpenShift Pipelines may not be installed or access is incomplete"
  exit 2
fi

if [[ $vuln -eq 1 ]]; then
  echo "VULNERABLE: $notes"
  exit 1
fi

if [[ $unknown -eq 1 ]]; then
  echo "UNKNOWN: no clearly dangerous binding found, but some RBAC objects could not be inspected"
  exit 2
fi

echo "PATCHED: no obviously overprivileged bindings found for pipeline service accounts"
exit 0