Privilege escalation via overbroad ClusterRoleBinding

Privilege escalation in Red Hat OpenShift Pipelines allows remote authenticated users to modify Kueue and cert-manager resources via cluster RBAC. The tekton-scheduler-rolebinding ClusterRoleBinding binds the system:authenticated group to the tekton-scheduler-role ClusterRole, granting write access to Kueue and cert-manager custom resources that should be limited to operator-controlled identities. Exposure requires cluster authentication and the presence of the Kueue or cert-manager CRDs; attackers can disrupt scheduling, delete other tenants' Workload objects, or trigger cert-manager to overwrite TLS Secrets such as the default ingress certificate.