EUVD-2026-55826
GHSA-g68c-wmxr-x3rh
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N
Scope set to Changed because successful exploitation crosses tenant security boundaries into other users' pods and secrets; PR:L confirmed by required tenant credential.
Primary rating from Vendor (redhat).
CVSS VectorVendor: redhat
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N
Lifecycle Timeline
2DescriptionCVE.org
A flaw was found in Data Science Pipelines. A restricted user, or tenant, can exploit an improper authorization vulnerability in the setDefaultServiceAccount function. By specifying a more privileged ServiceAccount (SA) during a CreateRun request, an attacker can bypass authorization checks. This allows the tenant to run their containers with elevated privileges, potentially leading to the disclosure of sensitive information (secrets) and the ability to execute commands within other users' pods.
AnalysisAI
Privilege escalation in Red Hat OpenShift AI's Data Science Pipelines component allows authenticated tenants to bypass authorization controls in the setDefaultServiceAccount function by submitting a crafted CreateRun request that references a more privileged ServiceAccount than they are entitled to use. Successful exploitation enables the tenant's pipeline containers to run with elevated Kubernetes RBAC permissions, resulting in cross-namespace secret disclosure and the ability to execute commands inside other tenants' pods. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires an authenticated session with at least tenant-level access to the Data Science Pipelines API in Red Hat OpenShift AI - specifically, the permission to submit CreateRun requests. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 score of 7.1 (High) with vector AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N accurately captures the network-accessible, low-complexity nature of the flaw but the unchanged scope metric arguably understates practical blast radius: cross-tenant pod exec and secret disclosure in a shared cluster breaks tenant isolation in a manner functionally equivalent to a scope change. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker with a valid tenant account on a shared Red Hat OpenShift AI cluster submits a CreateRun API request containing the name of a privileged ServiceAccount - such as one bound to a cluster-level role or another tenant's namespace - as the default SA parameter, exploiting the missing authorization check in setDefaultServiceAccount. The resulting pipeline container launches with that SA's RBAC permissions, enabling the attacker to list and extract Kubernetes secrets cluster-wide and use the Kubernetes API to exec into pods belonging to other tenants. … |
| Remediation | Consult the Red Hat advisory at https://access.redhat.com/security/cve/CVE-2026-18620 and apply any RHOAI update that addresses CVE-2026-18620; no exact patched version was confirmed in available data, so monitor the Bugzilla entry at https://bugzilla.redhat.com/show_bug.cgi?id=2510320 for fix version publication. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory all OpenShift AI deployments utilizing Data Science Pipelines and confirm multi-tenant configuration; document which external or internal users have authentication credentials. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Red Hat Openshift Ai Rhoai
View allUnauthenticated remote code execution affects Feast (the open-source ML feature store), where user-defined functions sto
Authentication bypass in the Models-as-a-Service (MaaS) API component of Red Hat OpenShift AI (RHOAI) lets any pod alrea
Kubernetes Service Account token disclosure in the odh-dashboard component of Red Hat OpenShift AI (RHOAI) lets an authe
Server-side request forgery in the file_type content detector of guardrails-detectors (a component shipped with Red Hat
Arbitrary file write in the Feast Feature Server's `/save-document` endpoint lets an unauthenticated remote attacker wri
Privilege escalation in Red Hat OpenShift AI (RHOAI) training operator overlay allows any namespace editor to manage Tra
Privilege escalation in Red Hat OpenShift AI's training-operator enables any user holding a standard Kubernetes edit or
MySQL DSN parameter injection in Red Hat OpenShift AI's Data Science Pipelines Operator (DSPO) allows a namespace editor
Privilege escalation in odh-dashboard, the web interface for Red Hat OpenShift AI (RHOAI), allows any authenticated dash
Privilege escalation in odh-dashboard (Red Hat OpenShift AI) allows an attacker who has obtained the dashboard's Service
The MaaS (Model-as-a-Service) Gateway component in Red Hat OpenShift AI (RHOAI) is improperly configured, enabling any l
Authentication bypass in the odh-dashboard web console of Red Hat OpenShift AI (RHOAI) lets a low-privileged actor alrea
Same technique Authentication Bypass
View allVendor StatusVendor
Share
External POC / Exploit Code
Leaving vuln.today