CVE-2026-10533: Openshift: openshift: non-admin user can bypass resourcequota and flood etcd with events causing cluster-wide api degradation
A flaw was found in OpenShift Container Platform. Completed pods with restartPolicy: Never do not count toward ResourceQuota pod limits, and Kubernetes events are not quota-scoped. A non-privileged user who can create pods in a namespace can exploit this to generate a large volume of events that accumulate in etcd, causing API server performance degradation across the cluster.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-10533?
The severity of CVE-2026-10533 is rated as medium with a score of 5.
How does CVE-2026-10533 affect OpenShift users?
CVE-2026-10533 allows non-admin users to bypass resource quota limits and flood etcd with events, causing API degradation.
What versions of OpenShift are affected by CVE-2026-10533?
CVE-2026-10533 affects the OpenShift Container Platform, particularly versions prior to the fix related to this vulnerability.
How can I mitigate the impact of CVE-2026-10533?
Mitigation of CVE-2026-10533 involves restricting non-privileged users' ability to create pods in namespaces or applying available patches.
Is there a fix available for CVE-2026-10533?
Yes, fixes for CVE-2026-10533 are usually included in updates for the OpenShift Container Platform, so users should apply the latest patches.