Summary
Everpure has addressed a privilege-escalation issue in the Portworx Operator when deployed on Red Hat OpenShift (OCP). Only under specific conditions during the initial provisioning of a Portworx storage cluster, a user holding only limited, namespace-scoped permissions could cause the operator to grant broader access than intended, potentially resulting in elevated privileges within the Kubernetes cluster.
The issue was identified through responsible disclosure and has been resolved. Everpure has no evidence that this issue has been exploited.
| CVE | Base CVSS 4.0 Score | Severity | Vector |
|---|---|---|---|
| CVE-2026-15140 | 7.7 | High | CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N |
Affected Product
Portworx Operator on Red Hat OpenShift (OLM-based installations), all releases prior to the fixed version: Portworx Operator 26.3.2.
Corrective Action
The issue is resolved in the following release. Everpure recommends that OpenShift customers upgrade at their earliest convenience:
Portworx Operator 26.3.2 and later.
Mitigating Control
For customers who cannot immediately upgrade, Everpure recommends the following as standard best practice:
Restrict the ability to create Portworx storage cluster resources to cluster administrators.
Follow least-privilege principles for namespace-scoped roles, and review role assignments granted to non-administrative users.
Applying the fixed release is the recommended path to fully remediate the issue.
Acknowledgement
Everpure thanks Iain Smart of AmberWolf for reporting this issue and for working collaboratively with us through coordinated disclosure. We appreciate the security research community's partnership in helping keep our customers safe.
Contacting Support
If you need assistance with this issue, please call Technical Services at +1 866-244-7121. If calling from outside the US, please select from the list of phone numbers here: Contact Us.
Support Escalation - How To Escalate a Case
Please see Customer Escalation Procedures & Contact Everpure Security for additional information.