The spec.database.customExtraParams field in the DSPA CR is a free-form JSON string copied into mysql.Config.Params and serialised through mysqlConfig.FormatDSN() then sql.Open("mysql", dsn). The go-sql-driver/mysql driver re-parses the DSN string and recognises driver-level keys, allowing a tenant to inject dangerous parameters.

Files: api/v1/dspipeline_types.go:257-266, controllers/database.go:88-110,165-180
Framework: ASVS V5.3.4 (Injection), V12.3 (File Access); OWASP K8s K02 (confused deputy)
CWE: CWE-74 / CWE-915 (Improperly Controlled Modification of Dynamically-Determined Object Attributes), CWE-829
CVSS v3.1: 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) – High

Attack Chain
Any namespace editor can create a DSPA CR (via aggregate-to-edit ClusterRole)

Attacker sets customExtraParams with allowAllFiles:true and allowCleartextPasswords:true

Attacker sets spec.database.externalDB.host to a MySQL server they control

The operator pod (not the tenant pod) opens a MySQL session with LOCAL INFILE enabled to the attacker's server

Attacker's MySQL server requests LOCAL INFILE /var/run/secrets/kubernetes.io/serviceaccount/token

That token is bound to the manager-role ClusterRole which holds pods/exec:* + clusterrolebindings:create cluster-wide

Result: namespace-editor to cluster-admin

Impact
A namespace editor can read arbitrary files from the DSPO controller-manager pod, including /var/run/secrets/kubernetes.io/serviceaccount/token – a token bound to the manager-role ClusterRole that holds pods/exec:* and clusterroles/clusterrolebindings:create cluster-wide, i.e. effective cluster-admin.

Remediation
Allow-list the keys accepted from CustomExtraParams (e.g. tls, charset, loc, timeout) before merging; reject allowAllFiles, allowCleartextPasswords, allowOldPasswords, allowFallbackToPlaintext. Set mysqlConfig.AllowAllFiles = false explicitly after FormatDSN round-trip, or build *mysql.Config directly and pass via mysql.NewConnector() instead of string DSN.