Bug 2510299 (CVE-2026-18611)
| Summary: | CVE-2026-18611 data-science-pipelines-operator: DSPO: Cryptographically weak secret generation (math/rand) for DB and S3 credentials | ||
|---|---|---|---|
| Product: | [Other] Security Response | Reporter: | OSIDB Bzimport <bzimport> |
| Component: | vulnerability | Assignee: | Product Security <prodsec-ir-bot> |
| Status: | NEW --- | QA Contact: | |
| Severity: | medium | Docs Contact: | |
| Priority: | medium | ||
| Version: | unspecified | CC: | security-response-team |
| Target Milestone: | --- | Keywords: | Security |
| Target Release: | --- | ||
| Hardware: | All | ||
| OS: | Linux | ||
| Whiteboard: | |||
| Fixed In Version: | Doc Type: | --- | |
| Doc Text: |
A flaw was found in the Data Science Pipelines Operator. This vulnerability allows an unauthenticated attacker to derive sensitive credentials, such as MariaDB root/user passwords and MinIO access/secret keys, if they can access the MinIO Route or MariaDB Service. The flaw occurs because the operator uses a cryptographically weak pseudo-random number generator (PRNG) to generate these credentials, making them predictable. Successful exploitation could lead to unauthorized access to all pipeline artifacts and metadata, resulting in significant information disclosure.
|
Story Points: | --- |
| Clone Of: | Environment: | ||
| Last Closed: | Type: | --- | |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
Finding The Data Science Pipelines Operator generates MariaDB root/user passwords and MinIO access/secret keys using math/rand seeded from time.Now().UnixNano() when the user does not supply their own credentials. File: controllers/dspipeline_params.go:204-212 Framework: ASVS V6.3.1 (Cryptographic Random); OWASP K8s K03 CWE: CWE-338 (Use of Cryptographically Weak PRNG) CVSS v3.1: 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) — High Detail The passwordGen function in controllers/dspipeline_params.go uses math/rand (not crypto/rand) seeded from time.Now().UnixNano() on every call. The output is used by RetrieveOrCreateSecret (lines 228-238) to generate the MariaDB root/user password and the MinIO MINIO_ACCESS_KEY / MINIO_SECRET_KEY. The DSPA .metadata.creationTimestamp (1-second resolution) and the operator pod's reconcile-loop timing leak the seed window to ~10^9 candidates, brute-forceable offline. Because rand.Seed is global, concurrent reconciles of two DSPAs share state. func passwordGen(n int) string { rand.Seed(time.Now().UnixNano()) var chars = []rune("abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ1234567890") b := make([]rune, n) for i := range b { b[i] = chars[rand.Intn(len(chars))] } return string(b) } Impact An unauthenticated attacker who can reach the MinIO Route (see related: MinIO exposed via public OpenShift Route) or the MariaDB Service can derive the generated credentials and read/write all pipeline artifacts and metadata. Compounding Factors MinIO exposed via public OpenShift Route with these weak credentials MariaDB deployed with MYSQL_ALLOW_EMPTY_PASSWORD=true (root account passwordless) No NetworkPolicy for MinIO pods Remediation Replace math/rand with crypto/rand: import crand "crypto/rand" func passwordGen(n int) string { const chars = "abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ1234567890" b := make([]byte, n) if _, err := crand.Read(b); err != nil { panic(err) } for i := range b { b[i] = chars[int(b[i])%len(chars)] } return string(b) }