CVE-2026-18617: DSPO Privilege Escalation Vulnerability

CVE-2026-18617 Overview

CVE-2026-18617 is a parameter injection vulnerability in the Data Science Pipelines Operator (DSPO). A namespace editor can inject dangerous parameters into the MySQL Data Source Name (DSN) string through the spec.database.customExtraParams field. Manipulating these parameters enables the MySQL LOCAL INFILE capability, letting an attacker exfiltrate sensitive files such as the service account token mounted inside the operator pod. Because the operator pod runs with elevated permissions, stealing its token allows a namespace editor to escalate to cluster-admin. The vulnerability is tracked under [CWE-915: Improperly Controlled Modification of Dynamically-Determined Object Attributes].

Critical Impact
A namespace editor can escalate to cluster-admin by exfiltrating the operator pod's service account token via a manipulated MySQL DSN.

Affected Products

Red Hat OpenShift AI (see Red Hat CVE Analysis CVE-2026-18617)
Data Science Pipelines Operator (DSPO) component
Distributions covered by advisories RHSA-2026:53261, RHSA-2026:53262, and RHSA-2026:53263

Discovery Timeline

2026-08-10 - CVE-2026-18617 published to NVD
2026-08-12 - Last updated in NVD database

Technical Details for CVE-2026-18617

Vulnerability Analysis

The Data Science Pipelines Operator builds a MySQL connection string from user-controllable fields in the DataSciencePipelinesApplication custom resource. The spec.database.customExtraParams field is appended to the DSN without validation against a permitted parameter allowlist. A namespace editor, who legitimately can create or edit these custom resources within their namespace, can pass connection parameters that alter the client's runtime behavior.

By setting parameters such as allowAllFiles=true and pointing the connection at an attacker-controlled MySQL server, the attacker enables the MySQL client's LOCAL INFILE feature. The rogue server then responds to any client query with a request for a local file path. The operator pod, acting as the MySQL client, reads the requested file from its own filesystem and transmits its contents back to the attacker's server.

The file targeted in this scenario is the Kubernetes service account token at /var/run/secrets/kubernetes.io/serviceaccount/token. Because the operator's service account carries cluster-scoped permissions, the exfiltrated token grants effective cluster-admin access, breaking the tenancy boundary enforced by namespace-scoped roles.

Root Cause

The operator concatenates attacker-controllable extra parameters directly into the MySQL DSN string with no validation or sanitization. It fails to enforce a strict allowlist of safe connection parameters, permitting security-sensitive options such as allowAllFiles to be enabled from untrusted input.

Attack Vector

The attacker requires namespace-editor privileges on a namespace where a DataSciencePipelinesApplication resource can be created or modified. The attacker stands up a malicious MySQL server, configures the custom resource to point at that server, and injects LOCAL INFILE-enabling parameters through customExtraParams. When the operator connects, the rogue server requests the service account token file, and the operator returns its contents. The attacker then authenticates to the Kubernetes API with the stolen token to perform cluster-admin actions.

No verified public exploit code is available. See Red Hat Bug Report #2510304 for additional technical detail.

Detection Methods for CVE-2026-18617

Indicators of Compromise

DataSciencePipelinesApplication resources whose spec.database.customExtraParams contain allowAllFiles, allowLoadLocalInfile, or similar file-access parameters.
Outbound MySQL connections from the DSPO operator pod to hosts outside the expected in-cluster database endpoints.
Kubernetes API activity performed with the operator's service account token from unexpected client IPs or user agents.
Reads of /var/run/secrets/kubernetes.io/serviceaccount/token inside the operator pod correlated with outbound MySQL traffic.

Detection Strategies

Audit all DataSciencePipelinesApplication custom resources across namespaces and flag any use of customExtraParams.
Alert on Kubernetes audit log entries that create or update DSPO custom resources containing LOCAL INFILE-related parameters.
Correlate operator service account API calls against a baseline of expected controller behavior and flag privilege-sensitive verbs such as create on clusterrolebindings.

Monitoring Recommendations

Enable Kubernetes API audit logging at the RequestResponse level for datasciencepipelinesapplications resources.
Monitor egress from operator pods and restrict it via NetworkPolicy to only known database endpoints.
Track service account token usage and rotate tokens on suspicion of exposure.

How to Mitigate CVE-2026-18617

Immediate Actions Required

Apply the fixed DSPO builds delivered in RHSA-2026:53261, RHSA-2026:53262, and RHSA-2026:53263.
Review existing DataSciencePipelinesApplication resources and remove any suspicious customExtraParams values.
Rotate the DSPO service account token and any credentials the operator can access.
Restrict namespace-editor permissions on datasciencepipelinesapplications to trusted users only.

Patch Information

Red Hat has released fixed packages. Refer to Red Hat CVE Analysis CVE-2026-18617 for version mapping and to the individual errata for update instructions.

Workarounds

Use admission control (OPA/Gatekeeper or Kyverno) to reject DataSciencePipelinesApplication resources that set customExtraParams or that reference database hosts outside an approved list.
Apply a NetworkPolicy that limits the DSPO pod's egress to internal database service endpoints, preventing connections to attacker-controlled MySQL servers.
Reduce the operator's service account permissions to the minimum required, so a token exfiltration does not translate to cluster-admin.

bash

# Example Gatekeeper-style constraint (pseudocode) blocking customExtraParams
# in DataSciencePipelinesApplication resources
apiVersion: constraints.gatekeeper.sh/v1beta1
kind: K8sDisallowedDSPOExtraParams
metadata:
  name: block-dspo-customextraparams
spec:
  match:
    kinds:
      - apiGroups: ["datasciencepipelinesapplications.opendatahub.io"]
        kinds: ["DataSciencePipelinesApplication"]
  parameters:
    disallowedFields:
      - spec.database.customExtraParams