Finding
The Data Science Pipelines Operator generates MariaDB root/user passwords and MinIO access/secret keys using math/rand seeded from time.Now().UnixNano() when the user does not supply their own credentials.

File: controllers/dspipeline_params.go:204-212
Framework: ASVS V6.3.1 (Cryptographic Random); OWASP K8s K03
CWE: CWE-338 (Use of Cryptographically Weak PRNG)
CVSS v3.1: 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) — High

Detail
The passwordGen function in controllers/dspipeline_params.go uses math/rand (not crypto/rand) seeded from time.Now().UnixNano() on every call. The output is used by RetrieveOrCreateSecret (lines 228-238) to generate the MariaDB root/user password and the MinIO MINIO_ACCESS_KEY / MINIO_SECRET_KEY.

The DSPA .metadata.creationTimestamp (1-second resolution) and the operator pod's reconcile-loop timing leak the seed window to ~10^9 candidates, brute-forceable offline. Because rand.Seed is global, concurrent reconciles of two DSPAs share state.



func passwordGen(n int) string {
    rand.Seed(time.Now().UnixNano())
    var chars = []rune("abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ1234567890")
    b := make([]rune, n)
    for i := range b {
        b[i] = chars[rand.Intn(len(chars))]
    }
    return string(b)
}
Impact
An unauthenticated attacker who can reach the MinIO Route (see related: MinIO exposed via public OpenShift Route) or the MariaDB Service can derive the generated credentials and read/write all pipeline artifacts and metadata.

Compounding Factors
MinIO exposed via public OpenShift Route with these weak credentials

MariaDB deployed with MYSQL_ALLOW_EMPTY_PASSWORD=true (root account passwordless)

No NetworkPolicy for MinIO pods

Remediation
Replace math/rand with crypto/rand:



import crand "crypto/rand"
func passwordGen(n int) string {
    const chars = "abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ1234567890"
    b := make([]byte, n)
    if _, err := crand.Read(b); err != nil { panic(err) }
    for i := range b { b[i] = chars[int(b[i])%len(chars)] }
    return string(b)
}