CVE-2026-10533

A flaw was found in OpenShift Container Platform. Completed pods with restartPolicy: Never do not count toward ResourceQuota pod limits, and Kubernetes events are not quota-scoped. A non-privileged user who can create pods in a namespace can exploit this to generate a large volume of events that accumulate in etcd, causing API server performance degradation across the cluster.

CVSS v3 5.0 MEDIUM

5.0^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 3.1 / Impact : 1.4

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact LOW

Scope CHANGED

References

Link	Resource
https://access.redhat.com/security/cve/CVE-2026-10533	Vendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2483727	Permissions Required

Configurations

Configuration 1 (hide)

cpe:2.3:a:redhat:openshift_container_platform:4.0:*:*:*:*:*:*:*

History

22 Jul 2026, 07:10

Type	Values Removed	Values Added
Summary		(es) Se encontró una falla en OpenShift Container Platform. Los pods completados con restartPolicy: Never no cuentan para los límites de pods de ResourceQuota, y los eventos de Kubernetes no están sujetos a cuota. Un usuario no privilegiado que puede crear pods en un namespace puede explotar esto para generar un gran volumen de eventos que se acumulan en etcd, causando degradación del rendimiento del servidor API en todo el clúster.

08 Jun 2026, 14:09

Type	Values Removed	Values Added
References	~~() https://access.redhat.com/security/cve/CVE-2026-10533 -~~	() https://access.redhat.com/security/cve/CVE-2026-10533 - Vendor Advisory
References	~~() https://bugzilla.redhat.com/show_bug.cgi?id=2483727 -~~	() https://bugzilla.redhat.com/show_bug.cgi?id=2483727 - Permissions Required
First Time		Redhat Redhat openshift Container Platform
CPE		cpe:2.3:a:redhat:openshift_container_platform:4.0:::::::*

01 Jun 2026, 15:16

Type	Values Removed	Values Added
New CVE

Information

Published : 2026-06-01 15:16

Updated : 2026-07-22 07:10

NVD link : CVE-2026-10533

Mitre link : CVE-2026-10533

CVE.ORG link : CVE-2026-10533

JSON object : View

Products Affected

redhat

openshift_container_platform

CWE

CWE-770

Allocation of Resources Without Limits or Throttling

{"id": "CVE-2026-10533", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-10533", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-06-02T13:38:55.741951Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "secalert@redhat.com", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 5.0, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:L", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "LOW", "confidentialityImpact": "NONE"}, "impactScore": 1.4, "exploitabilityScore": 3.1}, {"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 5.0, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:L", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "LOW", "confidentialityImpact": "NONE"}, "impactScore": 1.4, "exploitabilityScore": 3.1}]}, "affected": [{"source": "secalert@redhat.com", "affectedData": [{"cpes": ["cpe:/a:redhat:openshift:4"], "vendor": "Red Hat", "product": "Red Hat OpenShift Container Platform 4", "packageName": "openshift", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected"}]}], "published": "2026-06-01T15:16:33.443", "references": [{"url": "https://access.redhat.com/security/cve/CVE-2026-10533", "tags": ["Vendor Advisory"], "source": "secalert@redhat.com"}, {"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2483727", "tags": ["Permissions Required"], "source": "secalert@redhat.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "secalert@redhat.com", "description": [{"lang": "en", "value": "CWE-770"}]}], "descriptions": [{"lang": "en", "value": "A flaw was found in OpenShift Container Platform. Completed pods with restartPolicy: Never do not count toward ResourceQuota pod limits, and Kubernetes events are not quota-scoped. A non-privileged user who can create pods in a namespace can exploit this to generate a large volume of events that accumulate in etcd, causing API server performance degradation across the cluster."}, {"lang": "es", "value": "Se encontr\u00f3 una falla en OpenShift Container Platform. Los pods completados con restartPolicy: Never no cuentan para los l\u00edmites de pods de ResourceQuota, y los eventos de Kubernetes no est\u00e1n sujetos a cuota. Un usuario no privilegiado que puede crear pods en un namespace puede explotar esto para generar un gran volumen de eventos que se acumulan en etcd, causando degradaci\u00f3n del rendimiento del servidor API en todo el cl\u00faster."}], "lastModified": "2026-07-22T07:10:00.107", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:redhat:openshift_container_platform:4.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "932D137F-528B-4526-9A89-CD59FA1AB0FE"}], "operator": "OR"}]}], "sourceIdentifier": "secalert@redhat.com"}