Skip to content
CVE PROGRAM SOURCE RECORD8.8 High

CVE-2026-18617

Data-science-pipelines-operator: dspo: mysql dsn parameter injection via customextraparams enables local infile file exfiltration from operator pod

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
redhat

Description

A flaw was found in the Data Science Pipelines Operator (DSPO). A namespace editor can exploit a vulnerability in the spec.database.customExtraParams field, which allows for the injection of dangerous parameters into the MySQL Data Source Name (DSN) string. By manipulating these parameters, an attacker can enable LOCAL INFILE functionality and exfiltrate sensitive files, such as the service account token, from the operator pod. This can lead to privilege escalation, allowing a namespace editor to gain cluster-admin privileges.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Red Hat Red Hat OpenShift AI 2.25

Default version status: affected

  • 1785189332 to < *unaffected

Red Hat Red Hat OpenShift AI 2.25

Default version status: affected

  • 1788182334 to < *unaffected

Red Hat Red Hat OpenShift AI 3.3

Default version status: affected

  • 1785187936 to < *unaffected

Red Hat Red Hat OpenShift AI 3.4

Default version status: affected

  • 1784833428 to < *unaffected

Red Hat Red Hat OpenShift AI 3.4

Default version status: affected

  • 1787002057 to < *unaffected

Red Hat Red Hat OpenShift AI 3.5

Default version status: affected

  • 1786552271 to < *unaffected

Red Hat Red Hat OpenShift AI 3.5

Default version status: affected

  • 1786552250 to < *unaffected

References