CVE-2026-18608
HighCVSS 8.7Exploitation Probability (EPSS)
Low risk40th percentile - higher than 40% of all known CVEs
Summary
A flaw was found in the Data Science Pipelines Operator (DSPO) where its ClusterRole grants excessive privileges, including the ability to execute commands in pods and manage cluster-wide roles. If the DSPO pod is compromised, an attacker could leverage these privileges to gain full administrative control over the entire Kubernetes cluster.
Risk Assessment
The risk includes potential full cluster takeover if the operator pod is compromised, leading to severe security breaches.
Recommendation
Restrict the operator's ClusterRole to the least privilege necessary and implement additional security measures such as pod security policies.
Other vulnerabilities in Data Science Pipelines Operator
See all- CVE-2026-18617High
A flaw was found in the Data Science Pipelines Operator (DSPO) where the spec.database.customExtraParams field allows injection of dangerous parameters into the MySQL DSN string. An attacker with namespace editor privileges can enable LOCAL INFILE and exfiltrate sensitive files like the service account token, leading to privilege escalation to cluster-admin.
- CVE-2026-18611High
A flaw was found in the Data Science Pipelines Operator where credentials like MariaDB passwords and MinIO keys are generated using a cryptographically weak PRNG, making them predictable. An unauthenticated attacker with access to the MinIO Route or MariaDB Service can derive these credentials and gain unauthorized access to all pipeline artifacts and metadata.
Original NVD description (English source)
A flaw was found in the Data Science Pipelines Operator (DSPO). The operator's ClusterRole, which defines its permissions, includes extensive privileges beyond what is necessary for its operation. These excessive permissions, such as the ability to execute commands within pods and manage cluster-wide roles, could be exploited. If the DSPO pod were compromised, an attacker could leverage these privileges to gain full administrative control over the entire Kubernetes cluster.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS