Security Flaw in Data Science Pipelines by Red Hat

CVE-2026-18621

What is CVE-2026-18621?

A vulnerability exists in Data Science Pipelines that enables attackers with namespace editor privileges to circumvent security measures. By submitting a malicious Argo Workflow through the V1 API, the API server can be manipulated to create pods with elevated privileges, allowing attackers to execute code with node-root access. This flaw effectively turns the API server into a confused deputy, granting full control over the underlying node and potentially compromising the entire system.

References