CVE Feed

    Dashboard / CVE / CVE-2026-18617

    CVE-2026-18617

    A flaw was found in the Data Science Pipelines Operator (DSPO). A namespace editor can exploit a vulnerability in the spec.database.customExtraParams field, which allows for the injection of dangerous parameters into the MySQL Data Source Name (DSN) string. By manipulating these parameters, an attacker can enable LOCAL INFILE functionality and exfiltrate sensitive files, such as the service account token, from the operator pod. This can lead to privilege escalation, allowing a namespace editor to gain cluster-admin privileges.

    Published:Aug 10, 2026
    Last Modified:Sep 8, 2026
    EPS:Aug 10, 2026
    EPSS Score:0.00483
    CVSS Score:8.8

    Affected Products

    Vendor
    Redhat
    Product
    Openshift Ai

    Exploits

    No exploit reference

    Common Attack Pattern Enumeration and Classification (CAPEC)

    No CAPEC recorded yet

    Related CVEs

    CVE-2026-86332 (CVSS 6.5) — A flaw was found in odh-dashboard in Red Hat OpenShift AI. The backend-for-frontend route GET /api/nim-serving…
    CVE-2026-84185 (CVSS 5.9) — A flaw was found in the jwcrypto library, which is used for implementing Javascript Object Signing and Encrypt…
    CVE-2026-18393 (CVSS 5.4) — A flaw was found in FFmpeg. The tdsc_load_cursor() function writes beyond the bounds of a heap-allocated buffe…
    CVE-2026-80179 (CVSS 5.9) — A flaw was found in jwcrypto. A remote attacker can send a specially crafted JSON Web Encryption (JWE) token c…
    CVE-2026-15218 (CVSS 7.9) — A flaw was found in the maas-api and maas-controller ServiceAccounts within Red Hat OpenShift AI. These Servic…
    CVE-2026-18947 (CVSS 8.5) — A flaw was found in Feast. An authorization bypass vulnerability exists in the /materialize and /materialize-i…
    CVE-2026-18982 (CVSS 8.8) — A flaw was found in the RHOAI training-operator. This vulnerability allows a user with standard edit or admin …
    CVE-2026-18951 (CVSS 8.8) — A flaw was found in the Red Hat OpenShift AI (RHOAI) overlay for the training operator. The RHOAI overlay inco…
    CVE-2026-18950 (CVSS 8.8) — A flaw was found in odh-dashboard. An authenticated user of the dashboard can exploit a vulnerability related …
    CVE-2026-18949 (CVSS 8.8) — A flaw was found in odh-dashboard. This vulnerability allows an attacker, who has compromised the dashboard's …

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High