CVE-2026-18621 Overview
CVE-2026-18621 is a privilege escalation flaw in Data Science Pipelines (DSP) that allows namespace editors to bypass security hardening controls. Attackers submit a malicious Argo Workflow through the V1 API path, tricking the API server into acting as a confused deputy. The API server then creates pods with elevated privileges on behalf of the attacker. Successful exploitation grants node-root access, enabling arbitrary code execution and full control over the underlying Kubernetes node. The weakness is classified under [CWE-266: Incorrect Privilege Assignment].
Critical Impact
An authenticated namespace editor can escalate to node-root, gaining arbitrary code execution on the underlying Kubernetes node hosting Data Science Pipelines workloads.
Affected Products
- Red Hat OpenShift AI (Data Science Pipelines component)
- Red Hat Data Science Pipelines
- Deployments referenced in Red Hat advisories RHSA-2026:53261, RHSA-2026:53262, and RHSA-2026:53263
Discovery Timeline
- 2026-08-10 - CVE-2026-18621 published to NVD
- 2026-08-11 - Last updated in NVD database
Technical Details for CVE-2026-18621
Vulnerability Analysis
Data Science Pipelines integrates Argo Workflows to orchestrate ML tasks. Security hardening restricts what pods a namespace editor can directly create. The V1 API path for Argo Workflows fails to enforce equivalent constraints when workflow specifications are submitted. An attacker with edit privileges in a namespace submits a crafted workflow definition that requests elevated pod security parameters. The API server processes the workflow and instantiates pods using its own service account authority. Those pods run with capabilities the attacker cannot request directly, producing a confused deputy condition. The resulting pod grants access to the underlying node file system and container runtime.
Root Cause
The root cause is inconsistent authorization enforcement between direct pod creation and workflow-driven pod creation. Security hardening applied to the DSP admission path is not replicated on the Argo Workflow V1 API. Requests routed through V1 inherit privileges from the workflow controller rather than the submitting user.
Attack Vector
Exploitation requires network access to the cluster API and namespace editor credentials. The attacker submits a malicious workflow manifest through the V1 endpoint, referencing pod templates with host mounts, privileged flags, or hostPath volumes. Once the workflow controller creates the pod, the attacker executes commands inside it to break out to the node.
No verified proof-of-concept code is public. See the Red Hat CVE Analysis and Red Hat Bug Report #2510327 for further technical detail.
Detection Methods for CVE-2026-18621
Indicators of Compromise
- Argo Workflow submissions to V1 API endpoints containing privileged: true, hostPID, hostNetwork, or hostPath mounts referencing /, /var/run/docker.sock, or /etc/kubernetes.
- Pods created by the Argo workflow controller service account that run with a UID of 0 or mount node-level paths.
- Unexpected exec or attach sessions into workflow-spawned pods followed by writes to /host mount points.
- Audit log entries where a namespace editor create action on workflows.argoproj.io/v1alpha1 precedes pod creation with elevated securityContext fields.
Detection Strategies
- Enable Kubernetes API audit logging at the RequestResponse level for the argoproj.io API group and correlate submitter identity with resulting pod specifications.
- Deploy admission policy engines such as Kyverno or OPA Gatekeeper to flag workflow templates that request privileged pod configurations.
- Alert on any pod created in a data science namespace whose securityContext.privileged is true or whose volumes include hostPath entries.
Monitoring Recommendations
- Continuously monitor the Argo Workflow controller service account for pod creations that diverge from baseline templates.
- Track process execution inside pipeline pods for indicators of container escape, including nsenter, chroot /host, and access to /proc/1/root.
- Forward cluster audit logs and container runtime telemetry to a centralized analytics platform for cross-source correlation.
How to Mitigate CVE-2026-18621
Immediate Actions Required
- Apply the updates delivered in Red Hat advisories RHSA-2026:53261, RHSA-2026:53262, and RHSA-2026:53263.
- Audit namespace RoleBindings and remove edit privileges from users and service accounts that do not require pipeline submission rights.
- Review recent Argo Workflow submissions for privileged pod templates and terminate any suspicious workloads.
- Rotate credentials and service account tokens for any namespace where compromise is suspected.
Patch Information
Red Hat has released fixed versions of Data Science Pipelines through the referenced RHSA advisories. Consult the Red Hat CVE Analysis for CVE-2026-18621 for the current fixed package versions across supported OpenShift AI releases.
Workarounds
- Disable or restrict the Argo Workflow V1 API path until patches are applied, allowing only the hardened DSP submission path.
- Enforce Pod Security Admission at the restricted level in namespaces that run Data Science Pipelines to block privileged pod creation regardless of submitter.
- Apply Kyverno or Gatekeeper policies that reject workflow templates containing hostPath, hostPID, hostNetwork, or privileged: true.
- Segregate pipeline workloads onto dedicated nodes with limited access to sensitive cluster resources.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
