Bug 2510304 (CVE-2026-18617)
| Summary: | CVE-2026-18617 data-science-pipelines-operator: DSPO: MySQL DSN parameter injection via CustomExtraParams enables LOCAL INFILE file exfiltration from operator pod | ||
|---|---|---|---|
| Product: | [Other] Security Response | Reporter: | OSIDB Bzimport <bzimport> |
| Component: | vulnerability | Assignee: | Product Security DevOps Team <prodsec-dev> |
| Status: | NEW --- | QA Contact: | |
| Severity: | high | Docs Contact: | |
| Priority: | high | ||
| Version: | unspecified | CC: | security-response-team |
| Target Milestone: | --- | Keywords: | Security |
| Target Release: | --- | ||
| Hardware: | All | ||
| OS: | Linux | ||
| Whiteboard: | |||
| Fixed In Version: | Doc Type: | --- | |
| Doc Text: |
A flaw was found in the Data Science Pipelines Operator (DSPO). A namespace editor can exploit a vulnerability in the spec.database.customExtraParams field, which allows for the injection of dangerous parameters into the MySQL Data Source Name (DSN) string. By manipulating these parameters, an attacker can enable LOCAL INFILE functionality and exfiltrate sensitive files, such as the service account token, from the operator pod. This can lead to privilege escalation, allowing a namespace editor to gain cluster-admin privileges.
|
Story Points: | --- |
| Clone Of: | Environment: | ||
| Last Closed: | Type: | --- | |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
The spec.database.customExtraParams field in the DSPA CR is a free-form JSON string copied into mysql.Config.Params and serialised through mysqlConfig.FormatDSN() then sql.Open("mysql", dsn). The go-sql-driver/mysql driver re-parses the DSN string and recognises driver-level keys, allowing a tenant to inject dangerous parameters. Files: api/v1/dspipeline_types.go:257-266, controllers/database.go:88-110,165-180 Framework: ASVS V5.3.4 (Injection), V12.3 (File Access); OWASP K8s K02 (confused deputy) CWE: CWE-74 / CWE-915 (Improperly Controlled Modification of Dynamically-Determined Object Attributes), CWE-829 CVSS v3.1: 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) – High Attack Chain Any namespace editor can create a DSPA CR (via aggregate-to-edit ClusterRole) Attacker sets customExtraParams with allowAllFiles:true and allowCleartextPasswords:true Attacker sets spec.database.externalDB.host to a MySQL server they control The operator pod (not the tenant pod) opens a MySQL session with LOCAL INFILE enabled to the attacker's server Attacker's MySQL server requests LOCAL INFILE /var/run/secrets/kubernetes.io/serviceaccount/token That token is bound to the manager-role ClusterRole which holds pods/exec:* + clusterrolebindings:create cluster-wide Result: namespace-editor to cluster-admin Impact A namespace editor can read arbitrary files from the DSPO controller-manager pod, including /var/run/secrets/kubernetes.io/serviceaccount/token – a token bound to the manager-role ClusterRole that holds pods/exec:* and clusterroles/clusterrolebindings:create cluster-wide, i.e. effective cluster-admin. Remediation Allow-list the keys accepted from CustomExtraParams (e.g. tls, charset, loc, timeout) before merging; reject allowAllFiles, allowCleartextPasswords, allowOldPasswords, allowFallbackToPlaintext. Set mysqlConfig.AllowAllFiles = false explicitly after FormatDSN round-trip, or build *mysql.Config directly and pass via mysql.NewConnector() instead of string DSN.