CVE-2026-18617

Received Received - Intake

Data Science Pipelines Operator MySQL DSN Injection

Publication date: 2026-08-10

Last updated on: 2026-08-10

Assigner: Red Hat, Inc.

Description

A flaw was found in the Data Science Pipelines Operator (DSPO). A namespace editor can exploit a vulnerability in the spec.database.customExtraParams field, which allows for the injection of dangerous parameters into the MySQL Data Source Name (DSN) string. By manipulating these parameters, an attacker can enable LOCAL INFILE functionality and exfiltrate sensitive files, such as the service account token, from the operator pod. This can lead to privilege escalation, allowing a namespace editor to gain cluster-admin privileges.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-10

Last Modified

2026-08-10

Generated

2026-08-11

AI Q&A

2026-08-11

EPSS Evaluated

N/A

NVD

CVE-2026-18617

Affected Vendors & Products

Vendor	Product	Version / Range
redhat	data_science_pipelines_operator	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-915	The product receives input from an upstream component that specifies multiple attributes, properties, or fields that are to be initialized or updated in an object, but it does not properly control which attributes can be modified.

Attack-Flow Graph

Executive Summary

This vulnerability is in the Data Science Pipelines Operator (DSPO). A namespace editor can inject malicious parameters into the MySQL Data Source Name (DSN) string via the spec.database.customExtraParams field. This allows enabling LOCAL INFILE, which can be used to read sensitive files like the service account token from the operator pod, potentially leading to privilege escalation.

Impact Analysis

If you are a namespace editor or have similar permissions, an attacker could exploit this to gain cluster-admin privileges. This could allow unauthorized access to sensitive data, control over cluster resources, and potential compromise of the entire Kubernetes cluster.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating confidentiality requirements in GDPR and HIPAA. It may result in data breaches, non-compliance with data protection regulations, and potential legal or financial penalties due to compromised personal or health information.

Mitigation Strategies

Immediately restrict namespace editor permissions to prevent unauthorized access to spec.database.customExtraParams. Review and sanitize all DSN strings for suspicious parameters like LOCAL INFILE. Update the Data Science Pipelines Operator to the latest patched version if available.

Hi! I’m here to help you understand CVE-2026-18617. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70