CVE-2026-15140: Portworx Operator Privilege Escalation

CVE-2026-15140 Overview

CVE-2026-15140 is a privilege escalation vulnerability affecting the Portworx Operator when deployed on Red Hat OpenShift Container Platform (OCP). The flaw allows a user holding limited, namespace-scoped Kubernetes permissions to cause the operator to grant broader access than intended during the initial provisioning of a Portworx storage cluster. Successful exploitation can result in elevated privileges within the target Kubernetes cluster. The issue is tracked under [CWE-266] (Incorrect Privilege Assignment) and requires specific conditions during cluster bootstrap to trigger.

Critical Impact
A low-privileged namespace-scoped user can escalate to broader cluster access through the Portworx Operator during initial storage cluster provisioning.

Affected Products

Portworx Operator deployed on Red Hat OpenShift Container Platform (OCP)
Portworx storage cluster provisioning workflows on Kubernetes
Environments using namespace-scoped role bindings alongside the Portworx Operator

Discovery Timeline

2026-09-09 - CVE-2026-15140 published to the National Vulnerability Database
2026-09-09 - Last updated in NVD database

Technical Details for CVE-2026-15140

Vulnerability Analysis

The vulnerability resides in how the Portworx Operator provisions a storage cluster on Red Hat OpenShift. During initial provisioning, the operator processes user-supplied configuration and creates supporting Kubernetes resources such as service accounts, roles, and role bindings. Under specific conditions, the operator grants access beyond what the requesting user should be able to delegate. A namespace-scoped user can leverage this behavior to obtain permissions extending beyond their original namespace boundary. The result is a privilege escalation path that bypasses the intended Kubernetes role-based access control (RBAC) model.

Root Cause

The root cause is classified as [CWE-266] Incorrect Privilege Assignment. The Portworx Operator assigns privileges during storage cluster provisioning without correctly validating that the requesting principal is authorized to delegate those privileges. This design flaw allows the operator, which runs with elevated cluster permissions, to act as a confused deputy on behalf of a lower-privileged caller.

Attack Vector

An attacker requires valid, low-privileged, namespace-scoped credentials within an OpenShift cluster that runs the Portworx Operator. The attacker triggers or influences the initial provisioning of a Portworx storage cluster under conditions where the operator over-grants permissions. The attack is network-reachable through the Kubernetes API and does not require user interaction. Consult the Everpure Data Security Bulletin for detailed exploitation prerequisites and affected version ranges.

Detection Methods for CVE-2026-15140

Indicators of Compromise

Unexpected ClusterRoleBinding or RoleBinding objects created by the Portworx Operator service account referencing non-operator subjects.
Service accounts in application namespaces suddenly bound to cluster-scoped roles such as cluster-admin or storage-related cluster roles.
Kubernetes audit log entries showing the Portworx Operator creating RBAC resources on behalf of low-privileged users.
Portworx StorageCluster custom resources created or modified by identities without prior storage administration history.

Detection Strategies

Enable and review Kubernetes and OpenShift audit logs focusing on rbac.authorization.k8s.io API group create and update events initiated by the Portworx Operator.
Correlate StorageCluster custom resource creation events with subsequent RBAC changes to identify provisioning-triggered privilege grants.
Baseline expected RBAC objects owned by the Portworx Operator and alert on deviations that reference non-operator service accounts or users.

Monitoring Recommendations

Forward OpenShift audit logs to a centralized analytics platform for continuous review of privilege changes.
Monitor operator pod logs for provisioning errors, retries, or unusual reconciliation activity during storage cluster creation.
Alert on any account transitioning from namespace-scoped to cluster-scoped bindings within short time windows following Portworx provisioning.

How to Mitigate CVE-2026-15140

Immediate Actions Required

Inventory all clusters running the Portworx Operator on Red Hat OpenShift and identify which have pending or in-progress storage cluster provisioning.
Restrict who can create or modify Portworx StorageCluster custom resources to trusted cluster administrators only.
Audit existing RBAC bindings created by the Portworx Operator and remove any that grant privileges beyond the intended scope.
Review recent Kubernetes audit logs for suspicious provisioning activity by low-privileged accounts.

Patch Information

Refer to the Everpure Data Security Bulletin for the fixed Portworx Operator version and upgrade guidance. Apply the vendor-provided update to all affected OpenShift clusters as soon as feasible. Validate operator behavior in a non-production environment before rolling out changes cluster-wide.

Workarounds

Limit StorageCluster custom resource permissions to a small set of cluster administrators through OpenShift RBAC.
Complete Portworx storage cluster provisioning using a privileged administrator identity before granting namespace-scoped access to other users.
Apply OpenShift Security Context Constraints (SCCs) and admission policies that restrict which service accounts can trigger operator-driven RBAC changes.
Segment untrusted tenants into separate clusters where possible until the fixed operator version is deployed.

bash

# Audit RBAC bindings created by the Portworx Operator service account
oc get clusterrolebindings -o json | \
  jq '.items[] | select(.metadata.annotations."kubectl.kubernetes.io/last-applied-configuration" | test("portworx"))'

# Restrict StorageCluster CRD access to cluster administrators only
oc create clusterrole storagecluster-admin \
  --verb=create,update,patch,delete \
  --resource=storageclusters.core.libopenstorage.org

oc create clusterrolebinding storagecluster-admin-binding \
  --clusterrole=storagecluster-admin \
  --user=<trusted-admin-user>