Data-sciences-pipeline: dsp: v1 argo template path accepts arbitrary workflow spec, bypassing all v2 security hardening
Priority LOW 34CWE-266Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Privilege escalation
- Confidentiality · integrity · availability
- High · Low · Low
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA and Red Hat. Impact type from CWE-266.
Summary
A flaw was found in Data Science Pipelines (DSP). An attacker with namespace editor privileges can bypass security hardening by submitting a malicious Argo Workflow through the V1 API path. This allows the API server to create pods with elevated privileges, acting as a 'confused deputy' on behalf of the attacker. Successful exploitation grants the attacker node-root access, enabling arbitrary code execution and full control over the underlying node.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.0052 44th percentileScored 2026-11-07
Fix Fixed Red Hat: 6 advisories
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Red Hat | Red Hat OpenShift AI 2.25 | — | 1785189934 | Patch available | CNA |
| Red Hat | Red Hat OpenShift AI 2.25 | — | 1788256711 | Patch available | CNA |
| Red Hat | Red Hat OpenShift AI 3.3 | — | 1785187920 | Patch available | CNA |
| Red Hat | Red Hat OpenShift AI 3.4 | — | 1784924951 | Patch available | CNA |
| Red Hat | Red Hat OpenShift AI 3.4 | — | 1787173417 | Patch available | CNA |
| Red Hat | Red Hat OpenShift AI 3.4 | — | 1791866195 | Patch available | CNA |
| Red Hat | Red Hat AI Inference Server | — | — | Not affected | CNA |
| Red Hat | Red Hat AI Inference Server | — | — | Not affected | CNA |
| Red Hat | Red Hat AI Inference Server | — | — | Not affected | CNA |
| Red Hat | Red Hat AI Inference Server | — | — | Not affected | CNA |
| Red Hat | Red Hat AI Inference Server | — | — | Not affected | CNA |
| Red Hat | Red Hat AI Inference Server | — | — | Not affected | CNA |
| Red Hat | Red Hat AI Inference Server | — | — | Not affected | CNA |
| Red Hat | Red Hat AI Inference Server | — | — | Not affected | CNA |
| Red Hat | Red Hat AI Inference Server | — | — | Not affected | CNA |
| Red Hat | Red Hat AI Inference Server | — | — | Not affected | CNA |
| Red Hat | Red Hat AI Inference Server | — | — | Not affected | CNA |
| Red Hat | Red Hat AI Inference Server | — | — | Not affected | CNA |
| Red Hat | Red Hat AI Inference Server | — | — | Not affected | CNA |
- Red Hat OpenShift AI 2.25 VendorRed Hat Affected — Fixed in 1785189934 Patch available CNA
- Red Hat OpenShift AI 2.25 VendorRed Hat Affected — Fixed in 1788256711 Patch available CNA
- Red Hat OpenShift AI 3.3 VendorRed Hat Affected — Fixed in 1785187920 Patch available CNA
- Red Hat OpenShift AI 3.4 VendorRed Hat Affected — Fixed in 1784924951 Patch available CNA
- Red Hat OpenShift AI 3.4 VendorRed Hat Affected — Fixed in 1787173417 Patch available CNA
- Red Hat OpenShift AI 3.4 VendorRed Hat Affected — Fixed in 1791866195 Patch available CNA
- Red Hat AI Inference Server VendorRed Hat Affected — Fixed in — Not affected CNA
- Red Hat AI Inference Server VendorRed Hat Affected — Fixed in — Not affected CNA
- Red Hat AI Inference Server VendorRed Hat Affected — Fixed in — Not affected CNA
- Red Hat AI Inference Server VendorRed Hat Affected — Fixed in — Not affected CNA
- Red Hat AI Inference Server VendorRed Hat Affected — Fixed in — Not affected CNA
- Red Hat AI Inference Server VendorRed Hat Affected — Fixed in — Not affected CNA
- Red Hat AI Inference Server VendorRed Hat Affected — Fixed in — Not affected CNA
- Red Hat AI Inference Server VendorRed Hat Affected — Fixed in — Not affected CNA
- Red Hat AI Inference Server VendorRed Hat Affected — Fixed in — Not affected CNA
- Red Hat AI Inference Server VendorRed Hat Affected — Fixed in — Not affected CNA
- Red Hat AI Inference Server VendorRed Hat Affected — Fixed in — Not affected CNA
- Red Hat AI Inference Server VendorRed Hat Affected — Fixed in — Not affected CNA
- Red Hat AI Inference Server VendorRed Hat Affected — Fixed in — Not affected CNA
Remediation
Red Hat 6 advisories
- RHSA-2026:84734 Released 2026-10-19 · Red Hat rating CriticalRHOAI 3.4.5 - Red Hat OpenShift AI
- Red Hat OpenShift AI 3.4 registry.redhat.io/rhoai/odh-ai-gateway-payload-processing-rhel9, registry.redhat.io/rhoai/odh-automl-rhel9, registry.redhat.io/rhoai/odh-autorag-rhel9 +47
- RHSA-2026:65126 Released 2026-09-08 · Red Hat rating ImportantRHOAI 2.25.11 - Red Hat OpenShift AI
- Red Hat OpenShift AI 2.25 registry.redhat.io/rhoai/odh-built-in-detector-rhel9, registry.redhat.io/rhoai/odh-caikit-tgis-serving-rhel9, registry.redhat.io/rhoai/odh-dashboard-rhel9 +47
- RHSA-2026:60520 Released 2026-08-27 · Red Hat rating CriticalRHOAI 3.4.4 - Red Hat OpenShift AI
- Red Hat OpenShift AI 3.4 registry.redhat.io/rhoai/odh-automl-rhel9, registry.redhat.io/rhoai/odh-autorag-rhel9, registry.redhat.io/rhoai/odh-built-in-detector-rhel9 +47
Show 3 more Red Hat advisories
- RHSA-2026:53263 Released 2026-08-11 · Red Hat rating CriticalRHOAI 3.3.6 - Red Hat OpenShift AI
- Red Hat OpenShift AI 3.3 registry.redhat.io/rhoai/odh-built-in-detector-rhel9, registry.redhat.io/rhoai/odh-dashboard-rhel9, registry.redhat.io/rhoai/odh-data-science-pipelines-operator-controller-rhel9 +6
- RHSA-2026:53262 Released 2026-08-11 · Red Hat rating CriticalRHOAI 3.4.3 - Red Hat OpenShift AI
- Red Hat OpenShift AI 3.4 registry.redhat.io/rhoai/odh-built-in-detector-rhel9, registry.redhat.io/rhoai/odh-dashboard-rhel9, registry.redhat.io/rhoai/odh-data-science-pipelines-operator-controller-rhel9 +8
- RHSA-2026:53261 Released 2026-08-11 · Red Hat rating CriticalRHOAI 2.25.10 - Red Hat OpenShift AI
- Red Hat OpenShift AI 2.25 registry.redhat.io/rhoai/odh-built-in-detector-rhel9, registry.redhat.io/rhoai/odh-dashboard-rhel9, registry.redhat.io/rhoai/odh-data-science-pipelines-operator-controller-rhel9 +6
Vendor assessments
Red Hat
Red Hat rating: Important. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Red Hat OpenShift AI 2.25 | Fixed | RHSA-2026:53261, RHSA-2026:65126 |
| Red Hat OpenShift AI 3.3 | Fixed | RHSA-2026:53263 |
| Red Hat OpenShift AI 3.4 | Fixed | RHSA-2026:53262, RHSA-2026:60520, RHSA-2026:84734 |
Not affected: 4 products
- Red Hat AI Inference Server
- Red Hat OpenShift AI 2.25
- Red Hat OpenShift AI 3.3
- Red Hat OpenShift AI 3.4
Timeline
- 2026-10-02 Threatist record created from CVE-2026-18621
- 2026-10-03 Alias added: GHSA-6wxg-hpw6-m2x7
- 2026-10-19 Fix available: rhoai/odh-ml-pipelines-api-server-v2-rhel9@1791866195 · CNA
- 2026-10-19 1 new reference · CNA
- 2026-10-20 Fix available: RHSA-2026:84734 · Red Hat
- 2026-10-20 Affected versions changed · Red Hat
References
More Red Hat vulnerabilities
- TI-2019-15875 Protection mechanism failure in Jenkins Pipeline: Groovy Plugin KEVCVSS 3.1CRITICAL 9.9
- TI-2019-15874 Protection mechanism failure in Jenkins Script Security Plugin KEVCVSS 3.1CRITICAL 9.9
- TI-2019-08259 Underflow in PHP-FPM can lead to RCE KEVCVSS 3.1CRITICAL 9.8
- TI-2019-05363 Code injection in Elastic Kibana KEVCVSS 3.1CRITICAL 10.0
- TI-2019-03949 Out-of-bounds write in ESXi and Horizon DaaS KEVCVSS 3.1CRITICAL 9.8
- TI-2018-16080 A code execution vulnerability exists in the Stapler web framework used by Jenkins 2.153… KEVCVSS 3.1CRITICAL 9.8
Sources
- CVE-2026-18621 · CVE Program
- CVE-2026-18621 · NVD
- FIRST EPSS
- GHSA-6wxg-hpw6-m2x7 · GitHub Advisory Database · CC BY 4.0
- CVE-2026-18621 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences