Excessive Privilege Vulnerability in Data Science Pipelines Operator by Red Hat

CVE-2026-18608

What is CVE-2026-18608?

A vulnerability has been identified in the Data Science Pipelines Operator (DSPO) that involves excessive permissions in its ClusterRole configuration. This flaw grants broader access than necessary for its functionality, which can allow malicious actors to execute commands within pods and manage roles at a cluster-wide level. If an attacker successfully compromises the DSPO pod, they could exploit these extensive privileges to take complete administrative control over the associated Kubernetes cluster, posing a significant security risk.

References