CVE-2026-18620
HighCVSS 7.1Exploitation Probability (EPSS)
Low risk24th percentile - higher than 24% of all known CVEs
Summary
A vulnerability in Data Science Pipelines involves improper authorization in the setDefaultServiceAccount function. A restricted user can specify a more privileged ServiceAccount (SA) during a CreateRun request, bypassing authorization checks. This allows the tenant to run containers with elevated privileges, potentially leading to disclosure of sensitive information (secrets) and execution of commands within other users' pods.
Risk Assessment
An attacker can access sensitive data and execute commands in other users' pods, breaking tenant isolation and data security.
Recommendation
Update Data Science Pipelines to a patched version and enforce strict validation of service accounts.
Original NVD description (English source)
A flaw was found in Data Science Pipelines. A restricted user, or tenant, can exploit an improper authorization vulnerability in the setDefaultServiceAccount function. By specifying a more privileged ServiceAccount (SA) during a CreateRun request, an attacker can bypass authorization checks. This allows the tenant to run their containers with elevated privileges, potentially leading to the disclosure of sensitive information (secrets) and the ability to execute commands within other users' pods.