What is the CVSS score of CVE-2026-18617?

CVE-2026-18617 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.4%.

Which versions of Data Science Pipelines Operator are affected by CVE-2026-18617?

Red Hat OpenShift AI's Data Science Pipelines Operator contains a configuration injection vulnerability allowing namespace-privileged users to extract Kubernetes credentials and escalate to…. A patch is available.

How to fix or mitigate CVE-2026-18617?

Immediately audit all DSPO deployments for modifications to the spec.database.customExtraParams field and restrict namespace editor role assignments to essential personnel only. Within one week, implement network egress filtering on operator pods to prevent credential exfiltration, enable Kubernetes API audit logging for service account token access, and establish continuous monitoring for suspicious cluster-admin activity. Monitor Red Hat security advisories over the next 30 days and execute an emergency upgrade immediately upon vendor patch release.

Data Science Pipelines Operator CVE-2026-18617

EUVD-2026-55813 HIGH

Improperly Controlled Modification of Dynamically-Determined Object Attributes (CWE-915)

2026-08-10 redhat

GHSA-g6qh-932v-chpq

Privilege Escalation Red Hat Openshift Ai Rhoai Red Hat

8.8

CVSS 3.1 · Vendor: redhat

Severity by source

Vendor (redhat) PRIMARY

8.8 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

9.9 CRITICAL

S:C chosen over the reported S:U because successful exploitation yields cluster-admin access beyond the vulnerable DSPO namespace; all other metrics align with the reported vector.

3.1 AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

Red Hat

8.8 HIGH

qualitative

Primary rating from Vendor (redhat).

CVSS VectorVendor: redhat

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Aug 10, 2026 - 21:30 vuln.today

CVE Published

Aug 10, 2026 - 20:44 nvd

HIGH 8.8

DescriptionCVE.org

A flaw was found in the Data Science Pipelines Operator (DSPO). A namespace editor can exploit a vulnerability in the spec.database.customExtraParams field, which allows for the injection of dangerous parameters into the MySQL Data Source Name (DSN) string. By manipulating these parameters, an attacker can enable LOCAL INFILE functionality and exfiltrate sensitive files, such as the service account token, from the operator pod. This can lead to privilege escalation, allowing a namespace editor to gain cluster-admin privileges.

AnalysisAI

MySQL DSN parameter injection in Red Hat OpenShift AI's Data Science Pipelines Operator (DSPO) allows a namespace editor to enable the MySQL LOCAL INFILE feature via the unvalidated spec.database.customExtraParams field, enabling exfiltration of sensitive files - including Kubernetes service account tokens - from the operator pod. An attacker who exploits this can leverage the stolen token to impersonate the operator's service account and escalate privileges to cluster-admin level within the OpenShift cluster. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog.

Technical ContextAI

The vulnerability (CWE-915: Improperly Controlled Modification of Dynamically-Determined Object Attributes) resides in the DSPO custom resource's spec.database.customExtraParams field, which is passed directly into MySQL Data Source Name (DSN) string construction without sanitization. MySQL DSN strings accept key-value parameters that control driver behavior; among these is allowLocalInfile, which permits the MySQL server to instruct the client to read and transmit local files from the connecting host. Because the operator pod runs with a Kubernetes service account whose token resides at /var/run/secrets/kubernetes.io/serviceaccount/token, an attacker who injects allowLocalInfile=true and directs the operator to connect to a controlled MySQL endpoint can have that server request the token file. The affected product per CPE is cpe:2.3:a:red_hat:red_hat_openshift_ai_(rhoai):*:*:*:*:*:*:*:*, indicating all versions of RHOAI are in scope. CWE-915 reflects that the operator fails to constrain which DSN parameters a lower-privileged user may set, treating the customExtraParams field as a trusted pass-through.

RemediationAI

The primary remediation is to apply the vendor-provided patch from Red Hat once released; consult https://access.redhat.com/security/cve/CVE-2026-18617 for the specific errata and target RHOAI version. No exact fixed version was confirmed from the available data at time of analysis. As an immediate compensating control, restrict namespace editor role grants within RHOAI namespaces to only fully trusted users, as this role is the minimum required for exploitation. Where operationally feasible, disable or block the use of the spec.database.customExtraParams field through an admission webhook or OPA/Gatekeeper policy that rejects DSPO custom resources containing DSN injection strings such as allowLocalInfile - note this may break legitimate custom database configurations and should be tested before enforcing. Network policies that prevent the DSPO operator pod from initiating outbound connections to arbitrary MySQL endpoints can limit the attacker's ability to direct the operator to a controlled server, though this does not eliminate the injection vector itself.