Vulnerability · Published Sep 9, 2026 · Assigned by Everpure
CVE-2026-15140
High 7.7
In plain English
A high-severity security flaw in Portworx Operator from Everpure. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 29% of all known vulnerabilities).
Official description
A privilege-escalation issue in the Portworx Operator when deployed on Red Hat OpenShift (OCP). Only under specific conditions during the initial provisioning of a Portworx storage cluster, a user holding only limited, namespace-scoped permissions could cause the operator to grant broader access than intended, potentially resulting in elevated privileges within the Kubernetes cluster.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Everpure | Portworx Operator | 0 – through 26.3.1 |
Weakness: CWE-266 · Vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N