CVE-2026-15584: OpenShift Privilege Escalation Vulnerability

CVE-2026-15584 Overview

A privilege escalation vulnerability exists in the incluster-checks tool for Red Hat OpenShift. The tool creates privileged debug pods with host filesystem access in the shared default namespace. Any authenticated user holding the standard edit role can exec into these pods and obtain root access on the underlying cluster nodes. The flaw is tracked under CWE-250: Execution with Unnecessary Privileges and enables container-to-host escape through a legitimate cluster tooling artifact rather than a memory safety defect.

Critical Impact
A namespace-scoped edit user can pivot to root on any OpenShift node where an incluster-checks debug pod resides, breaking the tenancy boundary between application developers and cluster administrators.

Affected Products

Red Hat OpenShift clusters running the incluster-checks tooling
Multi-tenant OpenShift environments where non-admin users hold the edit role in the default namespace
Shared clusters where debug pods are provisioned into a common namespace

Discovery Timeline

2026-07-13 - CVE CVE-2026-15584 published to the National Vulnerability Database
2026-07-14 - Last updated in NVD database

Technical Details for CVE-2026-15584

Vulnerability Analysis

The incluster-checks tool performs cluster health validation by launching debug pods that mount the host filesystem and run with elevated privileges. These pods are provisioned in the default namespace, which is commonly readable and writable by any user with the built-in edit role. Because Kubernetes role-based access control (RBAC) grants pods/exec permissions to the edit role, any such user can attach a shell to the running debug pod. Once inside the container, the mounted host filesystem provides direct access to node binaries, credentials, and the container runtime socket.

The attack does not require a memory corruption primitive, an unauthenticated network foothold, or an exotic exploitation technique. It abuses a design choice in which privileged tooling shares a namespace with unprivileged workloads.

Root Cause

The root cause is a violation of least privilege as classified by CWE-250. The incluster-checks tool places pods that require host-level privileges into a namespace whose RBAC boundary is designed for application workloads. The combination of hostPath volume mounts, a privileged security context, and shared namespace access collapses the isolation model that OpenShift RBAC otherwise enforces.

Attack Vector

An authenticated user with the edit role in the default namespace lists the pods created by incluster-checks, identifies a debug pod, and issues oc exec or kubectl exec against it. The resulting shell runs inside a container that already holds host filesystem mounts and privileged capabilities. From there, the attacker reads node credentials, writes to /host paths, or executes binaries in the node's mount namespace, achieving root on the cluster node. Refer to the Red Hat CVE-2026-15584 Advisory and Red Hat Bugzilla Report #2499647 for vendor technical detail.

No public proof-of-concept exploit is available at the time of publication. No verified code examples are available for this issue; the mechanism is described in prose above.

Detection Methods for CVE-2026-15584

Indicators of Compromise

Unexpected pods/exec API server audit events targeting incluster-checks debug pods in the default namespace
Debug pods running with privileged: true or hostPath mounts of / or /host outside of an administrator namespace
Shell processes such as bash, sh, or chroot spawning inside incluster-checks pods from non-administrative user accounts
Node-level writes to /etc, /var/lib/kubelet, or /root originating from container PIDs tied to debug pods

Detection Strategies

Audit Kubernetes API server logs for create pods/exec verbs where the target pod carries an incluster-checks label and the requesting user is not a cluster administrator
Enforce admission-time policy checks that flag any pod in the default namespace requesting hostPath volumes or a privileged security context
Correlate container runtime telemetry with node process activity to identify shells launched inside privileged debug pods

Monitoring Recommendations

Stream OpenShift audit logs into a centralized analytics platform and alert on exec sessions against privileged pods
Baseline the expected lifecycle of incluster-checks pods and alert when they persist longer than a check run requires
Review RBAC bindings that grant the edit role in shared namespaces and monitor changes to those bindings

How to Mitigate CVE-2026-15584

Immediate Actions Required

Remove or disable the incluster-checks tool in shared clusters until a fixed version is deployed
Delete any long-lived debug pods created by the tool from the default namespace
Restrict the edit role in the default namespace and move workloads to purpose-built, isolated namespaces
Review OpenShift audit logs for prior exec activity against incluster-checks pods

Patch Information

Red Hat tracks remediation in the Red Hat CVE-2026-15584 Advisory and Red Hat Bugzilla Report #2499647. Apply the fixed version of incluster-checks when Red Hat publishes an update, and confirm that the tool provisions debug pods into a dedicated, administrator-only namespace.

Workarounds

Relocate incluster-checks execution to a namespace such as openshift-cluster-checks that is restricted to cluster-admin
Apply a SecurityContextConstraint (SCC) or Pod Security Admission policy that forbids privileged pods and hostPath mounts in the default namespace
Remove pods/exec permissions from the edit role for namespaces that host administrative tooling
Use Kubernetes network policies and admission controllers to prevent non-admin users from targeting system tooling pods

bash

# Example: restrict the default namespace with Pod Security Admission
oc label namespace default \
  pod-security.kubernetes.io/enforce=restricted \
  pod-security.kubernetes.io/enforce-version=latest --overwrite

# Example: remove pods/exec from the edit role scope in the default namespace
oc get rolebindings -n default -o wide
oc delete rolebinding <binding-granting-edit-to-users> -n default