EUVD-2026-55814
GHSA-6wxg-hpw6-m2x7
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L
Scope is Changed (S:C) because exploitation escapes namespace to node-root, crossing a Kubernetes security boundary; I:H and A:H reflect full node control per description.
Primary rating from Vendor (redhat).
CVSS VectorVendor: redhat
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L
Lifecycle Timeline
2DescriptionCVE.org
A flaw was found in Data Science Pipelines (DSP). An attacker with namespace editor privileges can bypass security hardening by submitting a malicious Argo Workflow through the V1 API path. This allows the API server to create pods with elevated privileges, acting as a 'confused deputy' on behalf of the attacker. Successful exploitation grants the attacker node-root access, enabling arbitrary code execution and full control over the underlying node.
AnalysisAI
Privilege escalation in Red Hat Data Science Pipelines (DSP) allows an authenticated namespace editor to gain node-root access by submitting a crafted Argo Workflow via the V1 API path. The API server, acting as a confused deputy (CWE-266), creates pods with elevated privileges on the attacker's behalf, effectively breaking out of Kubernetes namespace isolation. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires the attacker to hold namespace editor RBAC privileges within a Kubernetes namespace where Data Science Pipelines is deployed and the DSP V1 API path is accessible. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The official CVSS 3.1 score of 7.6 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L) is likely an underestimate of true impact. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker with legitimate namespace editor access in an OpenShift AI environment - such as a data scientist or MLOps engineer with scoped access - crafts an Argo Workflow manifest that specifies a privileged pod security context (e.g., privileged: true or hostPID: true) and submits it to the DSP V1 API endpoint. The DSP API server, using its own elevated service account, forwards the pod creation request to Kubernetes without stripping the malicious security context, resulting in a privileged pod being scheduled on a cluster node. … |
| Remediation | Consult the Red Hat security advisory at https://access.redhat.com/security/cve/CVE-2026-18621 and Bugzilla entry https://bugzilla.redhat.com/show_bug.cgi?id=2510327 for the official patch and fixed version, as no specific patched release version was available in the data provided at time of analysis. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, audit all Red Hat Data Science Pipelines deployments to identify users and service accounts with namespace editor permissions. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Red Hat Ai Inference Server
View allA remote attacker can trigger a heap out-of-bounds write in FFmpeg's DVD subtitle parser by providing a crafted MPEG-PS/
Image input manipulation in vLLM's multimodal preprocessing pipeline allows remote, unauthenticated network attackers to
Same weakness CWE-266 – Incorrect Privilege Assignment
View allVendor StatusVendor
Share
External POC / Exploit Code
Leaving vuln.today