CVE-2026-15584 Privilege Escalation in OpenShift incluster-checks Tool

A critical privilege escalation vulnerability, tracked as CVE-2026-15584, has been identified in the incluster-checks tool utilized by Red Hat OpenShift. This flaw enables any user possessing a standard "edit" role within the cluster to gain root-level access on the underlying cluster nodes. The vulnerability stems from the incluster-checks tool creating highly privileged debug pods that include host filesystem access and reside in the shared default namespace. Attackers can leverage their existing "edit" permissions to exec into these debug pods. Once inside, the host filesystem access allows them to manipulate system files or execute arbitrary commands directly on the host, thereby achieving full root access and potentially compromising the entire OpenShift cluster environment. This vulnerability affects OpenShift deployments where the incluster-checks tool is active.

Attack Chain

1. An attacker first obtains initial access to an OpenShift cluster with a standard "edit" role, a common permission level for developers or less privileged users.
2. The incluster-checks tool, a legitimate component of the OpenShift environment, creates specific debug pods as part of its operational function.
3. These debug pods are inadvertently configured with elevated privileges, including direct access to the host filesystem, and are placed within the shared default namespace.
4. The attacker identifies the presence and characteristics of these highly privileged debug pods, which are accessible due to their permissions.
5. Leveraging their existing "edit" role, the attacker uses the oc exec command to gain an interactive shell session within one of the identified debug pods.
6. Once inside the debug pod, the attacker exploits the host filesystem access capability to read sensitive host files, modify critical system configurations, or execute commands directly on the underlying OpenShift cluster node.
7. This manipulation allows the attacker to elevate their privileges to root on the cluster node, effectively taking full control of the host and potentially the entire OpenShift cluster.

Impact

Successful exploitation of CVE-2026-15584 leads to complete compromise of OpenShift cluster nodes, granting attackers root privileges. This means an attacker can gain unrestricted access to all data, applications, and services running on the affected nodes. This could lead to data exfiltration, service disruption, deployment of malicious payloads, or further lateral movement within the compromised environment. Given the nature of OpenShift environments, this could impact production systems, sensitive data, and expose internal networks, posing a significant risk to organizational security and operational integrity.

Recommendation

• Patch CVE-2026-15584 by updating your Red Hat OpenShift environment to a version where this vulnerability is addressed. Refer to Red Hat security advisories for specific patch versions.
• Review and restrict permissions for all users and service accounts to the principle of least privilege, especially concerning the "edit" role and its ability to interact with pods, to limit potential impact.
• Monitor OpenShift audit logs for unusual oc exec commands, particularly into debug or system-level pods, to detect suspicious activity.
• Inspect the configuration and creation of privileged pods within your OpenShift environment, focusing on those with host filesystem access, to identify and mitigate similar vulnerabilities.