CVE-2026-18608
HighCVSS 8.7Exploitation Probability (EPSS)
Low risk36th percentile - higher than 36% of all known CVEs
Summary
A flaw was found in the Data Science Pipelines Operator (DSPO) where its ClusterRole grants excessive privileges, including the ability to execute commands in pods and manage cluster-wide roles. If the DSPO pod is compromised, an attacker could leverage these privileges to gain full administrative control over the entire Kubernetes cluster.
Risk Assessment
The risk includes potential full cluster takeover if the operator pod is compromised, leading to severe security breaches.
Recommendation
Restrict the operator's ClusterRole to the least privilege necessary and implement additional security measures such as pod security policies.
Original NVD description (English source)
A flaw was found in the Data Science Pipelines Operator (DSPO). The operator's ClusterRole, which defines its permissions, includes extensive privileges beyond what is necessary for its operation. These excessive permissions, such as the ability to execute commands within pods and manage cluster-wide roles, could be exploited. If the DSPO pod were compromised, an attacker could leverage these privileges to gain full administrative control over the entire Kubernetes cluster.