CVE-2026-18608: Data Science Pipelines Operator Escalation

CVE-2026-18608 Overview

CVE-2026-18608 is a privilege management flaw in the Data Science Pipelines Operator (DSPO), a component used to orchestrate machine learning workflows on Kubernetes. The operator's ClusterRole grants permissions that exceed operational requirements, including the ability to execute commands inside pods and manage cluster-wide roles. An attacker who compromises the DSPO pod can leverage these permissions to escalate privileges and take administrative control of the entire Kubernetes cluster. The issue is tracked under [CWE-250: Execution with Unnecessary Privileges].

Critical Impact
Compromise of the DSPO pod allows an attacker to pivot from a single workload to full cluster-admin control, exposing all namespaces, secrets, and workloads.

Affected Products

Red Hat OpenShift AI (Data Science Pipelines Operator component)
Red Hat OpenShift deployments using DSPO for ML pipeline orchestration
Kubernetes clusters running affected DSPO ClusterRole configurations

Discovery Timeline

2026-08-10 - CVE-2026-18608 published to NVD
2026-08-11 - Last updated in NVD database

Technical Details for CVE-2026-18608

Vulnerability Analysis

The Data Science Pipelines Operator manages the lifecycle of ML pipeline resources on Kubernetes. Its ClusterRole binds permissions across the cluster rather than restricting them to the namespaces where pipelines run. The role grants verbs such as pods/exec, along with create, update, and delete rights on roles, rolebindings, clusterroles, and clusterrolebindings. These permissions violate the principle of least privilege.

An attacker who gains code execution inside the DSPO pod inherits the operator's service account token mounted at /var/run/secrets/kubernetes.io/serviceaccount/token. Using that token, the attacker can call the Kubernetes API with the operator's identity. Because the token maps to a ClusterRole with cluster-wide administrative verbs, the attacker can create arbitrary bindings, execute into any pod, and read secrets from any namespace.

Root Cause

The root cause is over-provisioning of the DSPO service account. Rather than scoping RBAC to the specific resources DSPO manages, the operator ships with broad cluster-scoped verbs. This aligns with [CWE-250], where a process runs with more privileges than its function requires.

Attack Vector

Exploitation requires initial access to the DSPO pod or its service account token. Once obtained, the attacker uses kubectl or direct API calls to create a ClusterRoleBinding that grants cluster-admin to an attacker-controlled service account. The attacker can then execute commands in workload pods, extract secrets, and deploy malicious controllers persistent across cluster reboots.

See the Red Hat CVE Analysis for CVE-2026-18608 for the vendor's technical breakdown.

Detection Methods for CVE-2026-18608

Indicators of Compromise

Unexpected ClusterRoleBinding or RoleBinding objects created by the DSPO service account
Kubernetes audit log entries showing pods/exec subresource calls originating from the DSPO service account against pods outside its managed namespaces
API requests from the DSPO pod referencing resources unrelated to pipeline execution, such as secrets in kube-system
New service accounts or tokens created shortly after DSPO pod activity

Detection Strategies

Enable Kubernetes API server audit logging and alert on write operations to clusterroles and clusterrolebindings by operator service accounts
Baseline the DSPO service account's normal API call patterns and flag deviations
Monitor for exec, attach, and portforward subresource activity attributed to DSPO

Monitoring Recommendations

Ingest Kubernetes audit logs into a centralized analytics platform for correlation with pod and workload telemetry
Track RBAC changes continuously and alert on privilege grants to service accounts outside the change window
Correlate DSPO pod process activity with outbound API server requests to detect token abuse

How to Mitigate CVE-2026-18608

Immediate Actions Required

Apply the fixed DSPO packages referenced in RHSA-2026:53261, RHSA-2026:53262, and RHSA-2026:53263
Audit the DSPO ClusterRole and remove verbs not required for pipeline orchestration
Rotate the DSPO service account token after patching to invalidate any previously exfiltrated credentials
Review existing ClusterRoleBindings for entries created by the DSPO service account and remove unauthorized bindings

Patch Information

Red Hat has released fixed DSPO packages via three security advisories: RHSA-2026:53261, RHSA-2026:53262, and RHSA-2026:53263. Details are available in Red Hat Bug Report #2510296. Apply the updates through the OpenShift Operator Lifecycle Manager or standard cluster update procedures.

Workarounds

Restrict network egress from the DSPO pod to the Kubernetes API server only, blocking attacker command-and-control channels
Apply a Kubernetes admission policy that denies creation of ClusterRoleBindings granting cluster-admin outside an approved allowlist
Deploy DSPO in a dedicated namespace and use NetworkPolicy to isolate it from workload namespaces
Enable Pod Security Admission at the restricted level for the DSPO namespace to limit container capabilities

bash

# Audit the DSPO ClusterRole for excessive verbs
kubectl get clusterrole data-science-pipelines-operator -o yaml

# List bindings tied to the DSPO service account
kubectl get clusterrolebindings -o json | \
  jq '.items[] | select(.subjects[]?.name=="data-science-pipelines-operator")'

# Rotate the service account token after patching
kubectl delete secret -n <dspo-namespace> \
  $(kubectl get sa data-science-pipelines-operator \
    -n <dspo-namespace> -o jsonpath='{.secrets[0].name}')