Aller au contenu
en Se connecter
7.6 Élevée

CVE-2026-18621 A flaw was found in Data Science Pipelines (DSP)

Description

A flaw was found in Data Science Pipelines (DSP). An attacker with namespace editor privileges can bypass security hardening by submitting a malicious Argo Workflow through the V1 API path. This allows the API server to create pods with elevated privileges, acting as a 'confused deputy' on behalf of the attacker. Successful exploitation grants the attacker node-root access, enabling arbitrary code execution and full control over the underlying node.

Produits et versions touchés

Produit Versions touchées Corrigé en
Red Hat AI Inference Server Versions non publiées
Red Hat OpenShift AI (RHOAI) Versions non publiées
Red Hat OpenShift AI 3.3 1785187920 premières → < 1785187920 1785187920
Red Hat OpenShift AI 2.25 1788256711 premières → < 1788256711 1788256711
Red Hat OpenShift AI 3.4 1791866195 premières → < 1791866195 1791866195

Références

Chronologie

  1. Publiée
  2. Dernière modification

Autres CVE de Red Hat AI Inference Server

Les 65 CVE de Red Hat AI Inference Server →
CVE-2026-114406 Ca-certificates: distrust emudhra intermediate ca certificates due to security concerns 6.8 Moyenne CVE-2026-92925 Redis: redis: out-of-bounds read via crafted cluster bus packets 7.1 Élevée CVE-2026-58049 FFmpeg's RASC video decoder (decode_dlta in libavcodec/rasc.c) performs 32-bit reads and writes at the row cursor before… 8.6 Élevée CVE-2026-54513 jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor 8.1 Élevée
Suivre cette CVE