CVE-2026-18611
HighCVSS 7.5Exploitation Probability (EPSS)
Low risk33th percentile - higher than 33% of all known CVEs
Summary
A flaw was found in the Data Science Pipelines Operator where credentials like MariaDB passwords and MinIO keys are generated using a cryptographically weak PRNG, making them predictable. An unauthenticated attacker with access to the MinIO Route or MariaDB Service can derive these credentials and gain unauthorized access to all pipeline artifacts and metadata.
Risk Assessment
The risk includes significant information disclosure and unauthorized access to pipeline data, potentially compromising data confidentiality and integrity.
Recommendation
Update the operator to a version using a secure random number generator and rotate all generated credentials.
Original NVD description (English source)
A flaw was found in the Data Science Pipelines Operator. This vulnerability allows an unauthenticated attacker to derive sensitive credentials, such as MariaDB root/user passwords and MinIO access/secret keys, if they can access the MinIO Route or MariaDB Service. The flaw occurs because the operator uses a cryptographically weak pseudo-random number generator (PRNG) to generate these credentials, making them predictable. Successful exploitation could lead to unauthorized access to all pipeline artifacts and metadata, resulting in significant information disclosure.