STIGQter: STIG Summary: Red Hat OpenShift Container Platform 4.x Security Technical Implementation Guide Version: 2 Release: 6 Benchmark Date: 01 Jul 2026:

Vulnerability scanning applications must implement privileged access authorization to all OpenShift components, containers, and container images for selected organization-defined vulnerability scanning activities.

DISA Rule

SV-257563r961563_rule

Vulnerability Number

V-257563

Group Title

SRG-APP-000414-CTR-001010

Rule Version

CNTR-OS-000770

Severity

CAT II

CCI(s)

• CCI-001067 - Implement privileged access authorization to organization-identified system components for organization-defined vulnerability scanning activities.

Weight

10

Fix Recommendation

If no vulnerability scanning tool is used, this requirement is Not Applicable.

Create a service if one does not already exist.

Change to the appropriate namespace by executing the following:

oc project <namespace>

Create Service Account in the Project by executing the following:

oc create sa <service_account_name>

Verify creation of the Service Account by executing the following:

oc get sa | grep <service_account_name>

Bind to the appropriate cluster RBAC role by executing the following:

oc adm policy add-cluster-role-to-user <role_name> -z <service_account_name>

For more information, refer to the following guides:
https://docs.openshift.com/container-platform/4.8/authentication/using-rbac.html

https://docs.openshift.com/container-platform/4.8/authentication/understanding-and-creating-service-accounts.html

https://docs.openshift.com/container-platform/4.8/authentication/using-service-accounts-in-applications.html

Check Contents

If no vulnerability scanning tool is used, this requirement is Not Applicable.

Identify the service accounts used by the vulnerability scanning tools. If the tool runs as a container on the platform, then service account information can be found in the pod details by executing the following:

(oc get pods to list pods)
oc get pod <POD_ID> -o jsonpath='{.spec.serviceAccount}{"\n"}'

If no service account exists for the vulnerability scanning tool, this is a finding.

View cluster role bindings to determine which role the service account is bound to by executing the following:

oc get clusterrolebinding -ojson | jq '.items[]|select(.subjects[]?|select(.kind == "ServiceAccount" and .name == "ingress-to-route-controller"))|{ "crb": .metadata.name, "roleRef": .roleRef, "subjects": .subjects}'

Find the role to which the service account is bound, if the service account is not bound to a cluster role, or the role does not provide sufficient access, this is a finding.

Vulnerability Number

V-257563

Documentable

False

Rule Version

CNTR-OS-000770

Severity Override Guidance

If no vulnerability scanning tool is used, this requirement is Not Applicable.

Identify the service accounts used by the vulnerability scanning tools. If the tool runs as a container on the platform, then service account information can be found in the pod details by executing the following:

(oc get pods to list pods)
oc get pod <POD_ID> -o jsonpath='{.spec.serviceAccount}{"\n"}'

If no service account exists for the vulnerability scanning tool, this is a finding.

View cluster role bindings to determine which role the service account is bound to by executing the following:

oc get clusterrolebinding -ojson | jq '.items[]|select(.subjects[]?|select(.kind == "ServiceAccount" and .name == "ingress-to-route-controller"))|{ "crb": .metadata.name, "roleRef": .roleRef, "subjects": .subjects}'

Find the role to which the service account is bound, if the service account is not bound to a cluster role, or the role does not provide sufficient access, this is a finding.

Check Content Reference

M

Target Key

5547