Skip to content
CVE PROGRAM SOURCE RECORD7.1 High

CVE-2026-18620

Data-sciences-pipeline: user-controlled serviceaccount for workflow pods without authorization check — confused deputy

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
redhat

Description

A flaw was found in Data Science Pipelines. A restricted user, or tenant, can exploit an improper authorization vulnerability in the setDefaultServiceAccount function. By specifying a more privileged ServiceAccount (SA) during a CreateRun request, an attacker can bypass authorization checks. This allows the tenant to run their containers with elevated privileges, potentially leading to the disclosure of sensitive information (secrets) and the ability to execute commands within other users' pods.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Red Hat Red Hat OpenShift AI 2.25

Default version status: affected

  • 1785189934 to < *unaffected

Red Hat Red Hat OpenShift AI 2.25

Default version status: affected

  • 1788256711 to < *unaffected

Red Hat Red Hat OpenShift AI 3.3

Default version status: affected

  • 1785187920 to < *unaffected

Red Hat Red Hat OpenShift AI 3.4

Default version status: affected

  • 1784924951 to < *unaffected

Red Hat Red Hat OpenShift AI 3.4

Default version status: affected

  • 1787173417 to < *unaffected

Red Hat Red Hat OpenShift AI 3.5

Default version status: affected

  • 1786552271 to < *unaffected

Red Hat Red Hat OpenShift AI 3.5

Default version status: affected

  • 1786552250 to < *unaffected

References