← CVE Intelligence

CVE-2026-18621

Data-sciences-pipeline: dsp: v1 argo template path accepts arbitrary workflow spec, bypassing all v2 security hardening PUBLISHED

Description (CNA)

A flaw was found in Data Science Pipelines (DSP). An attacker with namespace editor privileges can bypass security hardening by submitting a malicious Argo Workflow through the V1 API path. This allows the API server to create pods with elevated privileges, acting as a 'confused deputy' on behalf of the attacker. Successful exploitation grants the attacker node-root access, enabling arbitrary code execution and full control over the underlying node.

Affected (CNA)

Vendor / productVersions
Red Hat / Red Hat OpenShift AI 2.25unaffected 1785189934 before *
Red Hat / Red Hat OpenShift AI 2.25unaffected 1788256711 before *
Red Hat / Red Hat OpenShift AI 3.3unaffected 1785187920 before *
Red Hat / Red Hat OpenShift AI 3.4unaffected 1784924951 before *
Red Hat / Red Hat OpenShift AI 3.4unaffected 1787173417 before *
Red Hat / Red Hat OpenShift AI 3.4unaffected 1791866195 before *
Red Hat / Red Hat AI Inference Serverunaffected
Red Hat / Red Hat AI Inference Serverunaffected
Red Hat / Red Hat AI Inference Serverunaffected
Red Hat / Red Hat AI Inference Serverunaffected
Red Hat / Red Hat AI Inference Serverunaffected
Red Hat / Red Hat AI Inference Serverunaffected
Red Hat / Red Hat AI Inference Serverunaffected
Red Hat / Red Hat AI Inference Serverunaffected
Red Hat / Red Hat AI Inference Serverunaffected
Red Hat / Red Hat AI Inference Serverunaffected
Red Hat / Red Hat AI Inference Serverunaffected
Red Hat / Red Hat AI Inference Serverunaffected
Red Hat / Red Hat AI Inference Serverunaffected

CWE

CWE-266

References

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.