What is the CVSS score of CVE-2026-18621?

CVE-2026-18621 has a CVSS 3.1 base score of 7.6 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L. EPSS exploitation probability: 0.3%.

Which versions of Data Science Pipelines are affected by CVE-2026-18621?

Red Hat Data Science Pipelines contains a privilege escalation vulnerability (CVE-2026-18621) that allows authenticated namespace editors to escalate to root-level cluster access.. A patch is available.

How to fix or mitigate CVE-2026-18621?

Within 24 hours, audit all Red Hat Data Science Pipelines deployments to identify users and service accounts with namespace editor permissions. Within 7 days, restrict namespace editor role to essential personnel only, implement network policies limiting access to DSP API endpoints, and enable comprehensive audit logging of all Argo Workflow submissions through the V1 API. Within 30 days, establish monitoring of Red Hat security advisories for patch announcements, conduct a formal risk assessment against your organization's tolerance, and develop contingency plans including alternative data science platforms if patch timeline extends beyond 90 days.

Data Science Pipelines CVE-2026-18621

EUVD-2026-55814 HIGH

Incorrect Privilege Assignment (CWE-266)

2026-08-10 redhat

GHSA-6wxg-hpw6-m2x7

RCE Red Hat Openshift Ai Rhoai Red Hat Ai Inference Server Red Hat

7.6

CVSS 3.1 · Vendor: redhat

Severity by source

Vendor (redhat) PRIMARY

7.6 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L

vuln.today AI

9.9 CRITICAL

Scope is Changed (S:C) because exploitation escapes namespace to node-root, crossing a Kubernetes security boundary; I:H and A:H reflect full node control per description.

3.1 AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

Red Hat

7.6 HIGH

qualitative

Primary rating from Vendor (redhat).

CVSS VectorVendor: redhat

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

Low

Availability

Low

Lifecycle Timeline

Analysis Generated

Aug 10, 2026 - 21:28 vuln.today

CVE Published

Aug 10, 2026 - 20:44 nvd

HIGH 7.6

DescriptionCVE.org

A flaw was found in Data Science Pipelines (DSP). An attacker with namespace editor privileges can bypass security hardening by submitting a malicious Argo Workflow through the V1 API path. This allows the API server to create pods with elevated privileges, acting as a 'confused deputy' on behalf of the attacker. Successful exploitation grants the attacker node-root access, enabling arbitrary code execution and full control over the underlying node.

AnalysisAI

Privilege escalation in Red Hat Data Science Pipelines (DSP) allows an authenticated namespace editor to gain node-root access by submitting a crafted Argo Workflow via the V1 API path. The API server, acting as a confused deputy (CWE-266), creates pods with elevated privileges on the attacker's behalf, effectively breaking out of Kubernetes namespace isolation. Successful exploitation enables arbitrary code execution and full control over the underlying cluster node; no public exploit has been identified at time of analysis, and this is not listed in CISA KEV.

Technical ContextAI

Data Science Pipelines (DSP) is a component of Red Hat OpenShift AI (RHOAI) that orchestrates ML/AI workloads using Argo Workflows, an open-source Kubernetes-native workflow engine. The vulnerability exists in the V1 API path exposed by the DSP API server, which accepts Argo Workflow definitions from users with namespace editor RBAC privileges. The root cause (CWE-266: Incorrect Privilege Assignment) is that the API server does not properly restrict or sanitize the pod security context specified within submitted workflow manifests. As a result, it relays elevated pod configurations - such as hostPID, privileged containers, or unrestricted capabilities - to the Kubernetes API, using the API server's own (higher-privilege) service account rather than the submitting user's identity. CPE data identifies the affected product as cpe:2.3:a:red_hat:red_hat_ai_inference_server:*:*:*:*:*:*:*:*, though the description specifically names Data Science Pipelines, suggesting DSP is a subcomponent of the Red Hat AI Inference Server stack. This confused-deputy pattern is a well-known Kubernetes privilege escalation class.

RemediationAI

Consult the Red Hat security advisory at https://access.redhat.com/security/cve/CVE-2026-18621 and Bugzilla entry https://bugzilla.redhat.com/show_bug.cgi?id=2510327 for the official patch and fixed version, as no specific patched release version was available in the data provided at time of analysis. As a compensating control pending patching, restrict namespace editor RBAC bindings to only fully trusted users and service accounts in namespaces running Data Science Pipelines - this directly limits the attacker population. Additionally, deploy Kubernetes admission controllers (such as OPA Gatekeeper or Kyverno policies) that enforce restrictive PodSecurity standards (baseline or restricted) on the DSP namespace, blocking workflow-spawned pods from requesting privileged security contexts, hostPID, or elevated capabilities; note this may break legitimate DSP functionality requiring elevated pod permissions and should be tested in a non-production environment first. Audit existing namespace editor bindings in RHOAI/DSP namespaces for over-provisioned access. Monitor the V1 API path for anomalous workflow submissions specifying non-default security contexts.