Description
A flaw was found in Data Science Pipelines (DSP). An attacker with namespace editor privileges can bypass security hardening by submitting a malicious Argo Workflow through the V1 API path. This allows the API server to create pods with elevated privileges, acting as a 'confused deputy' on behalf of the attacker. Successful exploitation grants the attacker node-root access, enabling arbitrary code execution and full control over the underlying node.
Published: 2026-08-10
Score: 7.6 High
EPSS: n/a
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

An attacker who can edit a namespace can submit an arbitrary Argo Workflow via the legacy V1 API path of Data Science Pipelines. The API server then creates pods with elevated privileges because the request bypasses the hardened security controls introduced in V2. This produces a confused‑deputy scenario in which the workflow runs with node‑root privileges, allowing the attacker to execute arbitrary code and take full control of the underlying node. The weakness arises from improper permission control (CWE‑266).

Affected Systems

Red Hat AI Inference Server (v3) and Red Hat OpenShift AI. The flaw exists in the V1 API path of Data Science Pipelines used by these products and is applicable to any installation that has not yet applied the vendor’s fix.

Risk and Exploitability

The CVSS score is 7.6, indicating a high impact with potential for full system compromise. EPSS data is not available, and the vulnerability is not listed in the CISA KEV catalog. Likely exploitation requires an attacker to have namespace editor privileges; once in place, submitting a crafted workflow is straightforward, making the vulnerability highly exploitable within the affected environment.

Generated by OpenCVE AI on August 10, 2026 at 22:43 UTC.

Remediation

Vendor Workaround

To mitigate this issue, ensure that Data Science Project (DSP) namespaces enforce `pod-security.kubernetes.io/enforce: restricted`. Additionally, verify that the `pipeline-runner` ServiceAccount is not bound to `privileged` or `anyuid` Security Context Constraints (SCCs).

OpenCVE Recommended Actions

  • Enforce pod‑security.kubernetes.io/enforce: restricted on all Data Science Project namespaces
  • Verify that the pipeline‑runner ServiceAccount is not bound to privileged or anyuid Security Context Constraints
  • Upgrade to the latest Red Hat AI Inference Server version that contains the vendor‑approved fix

Generated by OpenCVE AI on August 10, 2026 at 22:43 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Tue, 11 Aug 2026 00:15:00 +0000

Type Values Removed Values Added
References
Metrics threat_severity

None

 threat_severity

Important

Mon, 10 Aug 2026 21:00:00 +0000

Type Values Removed Values Added
Description A flaw was found in Data Science Pipelines (DSP). An attacker with namespace editor privileges can bypass security hardening by submitting a malicious Argo Workflow through the V1 API path. This allows the API server to create pods with elevated privileges, acting as a 'confused deputy' on behalf of the attacker. Successful exploitation grants the attacker node-root access, enabling arbitrary code execution and full control over the underlying node.
Title Data-sciences-pipeline: dsp: v1 argo template path accepts arbitrary workflow spec, bypassing all v2 security hardening
First Time appeared Redhat
Redhat ai Inference Server
Redhat openshift Ai
Weaknesses CWE-266
CPEs cpe:/a:redhat:ai_inference_server:3
cpe:/a:redhat:openshift_ai
Vendors & Products Redhat
Redhat ai Inference Server
Redhat openshift Ai
References
Metrics cvssV3_1

{'score': 7.6, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L'}

Subscriptions

Redhat Ai Inference Server Openshift Ai
cve-icon MITRE

Status: PUBLISHED

Assigner: redhat

Published:

Updated: 2026-08-10T20:44:37.373Z

Reserved: 2026-08-03T08:02:21.941Z

Link: CVE-2026-18621

cve-icon Vulnrichment

No data.

cve-icon NVD

No data.

cve-icon Redhat

Severity : Important

Publid Date: 2026-08-10T18:50:45Z

Links: CVE-2026-18621 - Bugzilla

cve-icon OpenCVE Enrichment

Updated: 2026-08-10T22:45:05Z

Weaknesses
  • CWE-266

    Incorrect Privilege Assignment