Skip to content
fr Sign in
8.8 High

CVE-2026-18617 A flaw was found in the Data Science Pipelines Operator (DSPO)

Description

A flaw was found in the Data Science Pipelines Operator (DSPO). A namespace editor can exploit a vulnerability in the spec.database.customExtraParams field, which allows for the injection of dangerous parameters into the MySQL Data Source Name (DSN) string. By manipulating these parameters, an attacker can enable LOCAL INFILE functionality and exfiltrate sensitive files, such as the service account token, from the operator pod. This can lead to privilege escalation, allowing a namespace editor to gain cluster-admin privileges.

Affected products and versions

Product Affected versions Fixed in
Red Hat OpenShift AI (RHOAI) Versions not published
Red Hat OpenShift AI 3.3 1785187936 earliest → < 1785187936 1785187936
Red Hat OpenShift AI 2.25 1788182334 earliest → < 1788182334 1788182334
Red Hat OpenShift AI 3.4 1787002057 earliest → < 1787002057 1787002057
Red Hat OpenShift AI 3.5 1786552250 earliest → < 1786552250 1786552250

References

Timeline

  1. Published
  2. Last modified

Other CVEs of Red Hat OpenShift AI (RHOAI)

The 388 CVEs of Red Hat OpenShift AI (RHOAI) →
CVE-2026-83494 Training-operator: pytorchjob validateupdate casts oldjob from newobj, bypassing managedby immutability (asvs v5.1.3; upstream bug) Not rated CVE-2026-83493 Distributed-workloads: github actions pinned by mutable tag/branch, including third-party snyk/actions/setup@master Not rated CVE-2026-107912 Io.quarkus/quarkus-vertx-http: quarkus-vertx-http: authorization bypass in management interface via path concatenation flaw 7.7 High CVE-2026-120194 Json-glib: json-glib: infinite loop in json_path_query() with negative jsonpath slice step 7.5 High
Track this CVE