Security Advisory catalog CVE-2026-18620
cve-program · CVE-2026-18620 Published
A flaw was found in Data Science Pipelines. A restricted user, or tenant, can exploit an improper authorization vulnerability in the setDefaultServiceAccount function. By specifying a more privileged ServiceAccount (SA) during a CreateRun request, an attacker can bypass authorization checks. This allows the tenant to run their containers with elevated privileges, potentially leading to the disclosure of sensitive information (secrets) and the ability to execute commands within other users' pods.
Read the publisher's advisory Affected versions, risk and source history
cve-program · CVE-2026-18620 Published rhoai/odh-ml-pipelines-api-server-v2-rhel9 https://catalog.redhat.com/software/containers/
Publisher's version information Shown as published. These rules are not interpreted as NuGet package version ranges.
{
"vendor": "Red Hat",
"product": "Red Hat OpenShift AI 2.25",
"collectionURL": "https://catalog.redhat.com/software/containers/",
"packageName": "rhoai/odh-ml-pipelines-api-server-v2-rhel9",
"defaultStatus": "affected",
"versions": [
{
"version": "1785189934",
"lessThan": "*",
"versionType": "rpm",
"status": "unaffected"
}
],
"cpes": [
"cpe:/a:redhat:openshift_ai:2.25::el9"
]
} rhoai/odh-ml-pipelines-api-server-v2-rhel9 https://catalog.redhat.com/software/containers/
Publisher's version information Shown as published. These rules are not interpreted as NuGet package version ranges.
{
"vendor": "Red Hat",
"product": "Red Hat OpenShift AI 2.25",
"collectionURL": "https://catalog.redhat.com/software/containers/",
"packageName": "rhoai/odh-ml-pipelines-api-server-v2-rhel9",
"defaultStatus": "affected",
"versions": [
{
"version": "1788256711",
"lessThan": "*",
"versionType": "rpm",
"status": "unaffected"
}
],
"cpes": [
"cpe:/a:redhat:openshift_ai:2.25::el9"
]
} rhoai/odh-ml-pipelines-api-server-v2-rhel9 https://catalog.redhat.com/software/containers/
Publisher's version information Shown as published. These rules are not interpreted as NuGet package version ranges.
{
"vendor": "Red Hat",
"product": "Red Hat OpenShift AI 3.3",
"collectionURL": "https://catalog.redhat.com/software/containers/",
"packageName": "rhoai/odh-ml-pipelines-api-server-v2-rhel9",
"defaultStatus": "affected",
"versions": [
{
"version": "1785187920",
"lessThan": "*",
"versionType": "rpm",
"status": "unaffected"
}
],
"cpes": [
"cpe:/a:redhat:openshift_ai:3.3::el9"
]
} rhoai/odh-ml-pipelines-api-server-v2-rhel9 https://catalog.redhat.com/software/containers/
Publisher's version information Shown as published. These rules are not interpreted as NuGet package version ranges.
{
"vendor": "Red Hat",
"product": "Red Hat OpenShift AI 3.4",
"collectionURL": "https://catalog.redhat.com/software/containers/",
"packageName": "rhoai/odh-ml-pipelines-api-server-v2-rhel9",
"defaultStatus": "affected",
"versions": [
{
"version": "1784924951",
"lessThan": "*",
"versionType": "rpm",
"status": "unaffected"
}
],
"cpes": [
"cpe:/a:redhat:openshift_ai:3.4::el9"
]
} rhoai/odh-ml-pipelines-api-server-v2-rhel9 https://catalog.redhat.com/software/containers/
Publisher's version information Shown as published. These rules are not interpreted as NuGet package version ranges.
{
"vendor": "Red Hat",
"product": "Red Hat OpenShift AI 3.4",
"collectionURL": "https://catalog.redhat.com/software/containers/",
"packageName": "rhoai/odh-ml-pipelines-api-server-v2-rhel9",
"defaultStatus": "affected",
"versions": [
{
"version": "1787173417",
"lessThan": "*",
"versionType": "rpm",
"status": "unaffected"
}
],
"cpes": [
"cpe:/a:redhat:openshift_ai:3.4::el9"
]
} rhoai/odh-latency-predictor-prediction-rhel9 https://catalog.redhat.com/software/containers/
Publisher's version information Shown as published. These rules are not interpreted as NuGet package version ranges.
{
"vendor": "Red Hat",
"product": "Red Hat OpenShift AI 3.5",
"collectionURL": "https://catalog.redhat.com/software/containers/",
"packageName": "rhoai/odh-latency-predictor-prediction-rhel9",
"defaultStatus": "affected",
"versions": [
{
"version": "1786552271",
"lessThan": "*",
"versionType": "rpm",
"status": "unaffected"
}
],
"cpes": [
"cpe:/a:redhat:openshift_ai:3.5::el9"
]
} rhoai/odh-latency-predictor-training-rhel9 https://catalog.redhat.com/software/containers/
Publisher's version information Shown as published. These rules are not interpreted as NuGet package version ranges.
{
"vendor": "Red Hat",
"product": "Red Hat OpenShift AI 3.5",
"collectionURL": "https://catalog.redhat.com/software/containers/",
"packageName": "rhoai/odh-latency-predictor-training-rhel9",
"defaultStatus": "affected",
"versions": [
{
"version": "1786552250",
"lessThan": "*",
"versionType": "rpm",
"status": "unaffected"
}
],
"cpes": [
"cpe:/a:redhat:openshift_ai:3.5::el9"
]
} Original source record · Cite this exact observation · Complete original publisher JSON