Bug 2510296 (CVE-2026-18608)

Summary:	CVE-2026-18608 data-science-pipelines-operator: DSPO: Operator ClusterRole grants pods/exec:, kubeflow.org /*, and ClusterRole/Binding CRUD cluster-wide
Product:	[Other] Security Response	Reporter:	OSIDB Bzimport <bzimport>
Component:	vulnerability	Assignee:	Product Security <prodsec-ir-bot>
Status:	NEW ---	QA Contact:
Severity:	high	Docs Contact:
Priority:	high
Version:	unspecified	CC:	security-response-team
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	---
Doc Text:	A flaw was found in the Data Science Pipelines Operator (DSPO). The operator's ClusterRole, which defines its permissions, includes extensive privileges beyond what is necessary for its operation. These excessive permissions, such as the ability to execute commands within pods and manage cluster-wide roles, could be exploited. If the DSPO pod were compromised, an attacker could leverage these privileges to gain full administrative control over the entire Kubernetes cluster.	Story Points:	---
Clone Of:		Environment:
Last Closed:		Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:

Description OSIDB Bzimport 2026-08-03 07:12:17 UTC

Finding
The DSPO manager-role ClusterRole, bound cluster-wide to the controller ServiceAccount, includes permissions far beyond what the operator requires:

pods, pods/exec, pods/log with verbs ['*'] – the operator never calls pods/exec

kubeflow.org resources ['*'] with verbs ['*']

clusterrolebindings and clusterroles with verbs create, delete, get, list, update, watch

apiGroups: ['*'] for deployments and services

The pods/exec verb is inherited from upstream KFP RBAC for the workflow controller, but is granted at cluster scope to the operator itself.

File: config/rbac/role.yaml:46-52 (pods/exec *), :170-175 (kubeflow.org * / *), :196-211 (clusterroles/clusterrolebindings CRUD)
Framework: OWASP K8s K02; CIS K8s 5.1.3 (minimise wildcards); STIG V-254800
CWE: CWE-250 (Execution with Unnecessary Privileges)
CVSS v3.1: 8.2 (AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:N) – High (post-compromise blast radius)

Impact
Any code-execution or token-leak in the DSPO pod yields effective cluster-admin. Combined with pods/exec:* on every namespace's pods and clusterrolebindings:create, compromise of the DSPO pod is full-cluster compromise.

This finding is the blast radius amplifier for the DSN parameter injection finding (RHOAIENG-67935: DSPO: MySQL DSN parameter injection via CustomExtraParams enables LOCAL INFILE file exfiltration from operator pod
Resolved
). That attack chain exfiltrates the operator SA token, and these overprivileged permissions are what converts that token into cluster-admin.

Remediation
Drop pods/exec, pods *, kubeflow.org */*, seldondeployments *, apiGroups:'*' from the operator role. The operator only needs: apps/deployments, services, secrets, configmaps, roles/rolebindings, routes, networkpolicies, servicemonitors, and the DSPA/Argo CRDs. Move workflow-specific verbs to the namespace-scoped Role templates only.