S3 credentials included when exporting elyra notebook
Priority LOW 34CWE-200Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Information disclosure
- Confidentiality · integrity · availability
- High · None · None
- Fix status
- Partial Red Hat: 1 without a fix
Attack profile from CVSS 3.1 · CNA. Fix status from CNA and Red Hat. Impact type from CWE-200.
Summary
A flaw was found in Red Hat OpenShift Data Science. When exporting a pipeline from the Elyra notebook pipeline editor as Python DSL or YAML, it reads S3 credentials from the cluster (ds pipeline server) and saves them in plain text in the generated output instead of an ID for a Kubernetes secret.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.0047 40th percentileScored 2026-11-07
Fix Partial odh-dashboard: 1.28.1Red Hat: 1 without a fix
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | odh-dashboard | — | 1.28.1 | Patch available | CNA |
| Red Hat | Red Hat OpenShift Data Science (RHODS) | — | — | No fix listed | CNA |
- odh-dashboard Vendor— Affected — Fixed in 1.28.1 Patch available CNA
- Red Hat OpenShift Data Science (RHODS) VendorRed Hat Affected — Fixed in — No fix listed CNA
CPE configurations NVD · 2
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:opendatahub:open_data_hub_dashboard:*:*:*:*:*:*:*:* | before 1.28.1 | Vulnerable | Opendatahub |
| cpe:2.3:a:redhat:openshift_data_science:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | Red Hat |
- cpe:2.3:a:opendatahub:open_data_hub_dashboard:*:*:*:*:*:*:*:* Versions before 1.28.1 Vulnerable ·Opendatahub
- cpe:2.3:a:redhat:openshift_data_science:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Red Hat
Remediation
- Fix · CNA odh-dashboard Fixed in 1.28.1
Vendor assessments
Red Hat
Red Hat rating: Important. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Red Hat OpenShift Data Science (RHODS) | Affected | No fix yet |
Timeline
- 2026-10-02 Threatist record created from CVE-2023-3361
- 2026-10-03 Alias added: GHSA-gj4f-3qq5-j78j
References
More Red Hat Openshift Data Science vulnerabilities
- TI-2023-23979 The HTTP/2 protocol allows a denial of service (server resource consumption) because… KEVCVSS 3.1HIGH 7.5
- TI-2023-00874 Odh-notebook-controller-container: missing authorization allows for file contents disclosure CVSS 3.1CRITICAL 9.8
- TI-2024-07004 Odh-dashboard: odh-model-controller: cross-model authentication bypass in openshift ai CVSS 3.1HIGH 8.8
Sources
- CVE-2023-3361 · CVE Program
- CVE-2023-3361 · NVD
- FIRST EPSS
- GHSA-gj4f-3qq5-j78j · GitHub Advisory Database · CC BY 4.0
- CVE-2023-3361 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences