What is the CVSS score of EUVD-2026-55824?

EUVD-2026-55824 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.4%.

Which versions of OpenShift AI are affected by EUVD-2026-55824?

Red Hat OpenShift AI's Data Science Pipelines Operator contains a credential derivation vulnerability (CVE-2026-18611) that enables unauthenticated attackers to compute valid MariaDB and MinIO…. A patch is available.

How to fix or mitigate EUVD-2026-55824?

Within 24 hours, identify all deployed instances of Red Hat OpenShift AI Data Science Pipelines Operator and assess whether MinIO Routes or MariaDB Services are network-accessible from untrusted sources. Within 7 days, immediately restrict inbound access to MinIO and MariaDB services to trusted networks only using firewall rules and OpenShift network policies, and deploy monitoring for unauthorized connection attempts. Within 30 days, continue monitoring Red Hat advisories; no vendor-released patch identified at time of analysis, but apply immediately upon availability. Until patched, maintain strict network access controls as your primary risk mitigation.

OpenShift AI EUVD-2026-55824

| CVE-2026-18611 HIGH

Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG) (CWE-338)

2026-08-10 redhat

GHSA-5qmg-pgg7-3rjj

Authentication Bypass Information Disclosure Red Hat Openshift Ai Rhoai Red Hat

7.5

CVSS 3.1 · Vendor: redhat

Severity by source

Vendor (redhat) PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

vuln.today AI

7.5 HIGH

Services are network-exposed, no authentication required per PR:N; weak PRNG makes credential derivation low-complexity; only confidentiality is impacted with no integrity or availability effect.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Red Hat

7.5 MEDIUM

qualitative

Primary rating from Vendor (redhat).

CVSS VectorVendor: redhat

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Aug 10, 2026 - 21:32 vuln.today

CVE Published

Aug 10, 2026 - 20:45 nvd

HIGH 7.5

DescriptionCVE.org

A flaw was found in the Data Science Pipelines Operator. This vulnerability allows an unauthenticated attacker to derive sensitive credentials, such as MariaDB root/user passwords and MinIO access/secret keys, if they can access the MinIO Route or MariaDB Service. The flaw occurs because the operator uses a cryptographically weak pseudo-random number generator (PRNG) to generate these credentials, making them predictable. Successful exploitation could lead to unauthorized access to all pipeline artifacts and metadata, resulting in significant information disclosure.

AnalysisAI

Credential derivation in Red Hat OpenShift AI's Data Science Pipelines Operator allows unauthenticated remote attackers to predict MariaDB root/user passwords and MinIO access/secret keys by exploiting a cryptographically weak PRNG (CWE-338). Any attacker who can reach the MinIO Route or MariaDB Service over the network can compute valid credentials without prior authentication, then access all pipeline artifacts and metadata stored in the system. No active exploitation is confirmed and no public exploit code has been identified at time of analysis, but the CVSS 7.5 High rating with AV:N and PR:N reflects a no-authentication-barrier condition against exposed services.

Technical ContextAI

The Data Science Pipelines Operator (DSPO) is a component of Red Hat OpenShift AI (RHOAI) responsible for deploying and managing AI/ML pipeline infrastructure, including MariaDB (pipeline metadata store) and MinIO (artifact object storage). Per CPE cpe:2.3:a:red_hat:red_hat_openshift_ai_(rhoai):*:*:*:*:*:*:*:*, all RHOAI versions are potentially in scope as no fixed upper bound is present in the CPE string. CWE-338 (Use of Cryptographically Weak Pseudo-Random Number Generator) identifies the root cause: the operator generates MariaDB root/user passwords and MinIO access/secret key pairs using a PRNG that is insufficiently unpredictable. Cryptographic best practice requires a CSPRNG (e.g., /dev/urandom, crypto/rand) for secret material generation; using a weak alternative - such as one seeded with a guessable value like a Unix timestamp, process ID, or sequential counter - allows an adversary to reconstruct the seed and directly compute the generated credentials without interacting with any authentication layer.

RemediationAI

Patch availability is referenced via the Red Hat security advisory at https://access.redhat.com/security/cve/CVE-2026-18611, but an exact patched version number is not confirmed in the available intelligence - consult the advisory directly for the authoritative fixed release and apply it as the primary remediation step. Until a confirmed patch is applied, consider these specific compensating controls: restrict network access to the MinIO Route and MariaDB Service using OpenShift NetworkPolicy objects, scoping ingress to only the pods and namespaces that require pipeline access and preventing unauthenticated external reachability (note that NetworkPolicy rules require correct label-selector configuration and must be verified after any operator upgrade, as label schemes may change); rotate all existing MariaDB and MinIO credentials immediately if operator-generated defaults remain in use, and supply externally managed, cryptographically strong credentials via Kubernetes Secrets rather than relying on operator-generated values. Removing or restricting the public MinIO Route eliminates the network-level prerequisite for the most accessible attack path.