Skip to content
Fencer Intel
high 7.6

CVE-2026-18621 json

Data-sciences-pipeline: dsp: v1 argo template path accepts arbitrary workflow spec, bypassing all v2 security hardening

published 2mo ago modified 21d ago also EUVD-2026-55814

cvss
7.6
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
0.5%
EPSS 0.5% chance of exploitation in 30 days, percentile 44%
public exploits
0
none known

Summary

A flaw was found in Data Science Pipelines (DSP). An attacker with namespace editor privileges can bypass security hardening by submitting a malicious Argo Workflow through the V1 API path. This allows the API server to create pods with elevated privileges, acting as a 'confused deputy' on behalf of the attacker. Successful exploitation grants the attacker node-root access, enabling arbitrary code execution and full control over the underlying node.

Patch / fix

  • Red Hat Red Hat OpenShift AI 2.25 1785189934, 1788256711
  • Red Hat Red Hat OpenShift AI 3.3 1785187920
  • Red Hat Red Hat OpenShift AI 3.4 1784924951, 1787173417, 1791866195

Is CVE-2026-18621 in your stack? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.

Check with Fencer

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2026-18621 updated cvss 7.6

data-sciences-pipeline: DSP: V1 Argo template path accepts arbitrary Workflow spec, bypassing all v2 security hardening

  • Red Hat OpenShift AI 2.25 rhoai/odh-ml-pipelines-api-server-v2-rhel9 1785189934, rhoai/odh-ml-pipelines-api-server-v2-rhel9 1788256711
    fixed: vendor fix RHSA-2026:65126
  • Red Hat OpenShift AI 3.3 rhoai/odh-ml-pipelines-api-server-v2-rhel9 1785187920
    fixed: vendor fix RHSA-2026:53263
  • Red Hat OpenShift AI 3.4 rhoai/odh-ml-pipelines-api-server-v2-rhel9 1784924951, rhoai/odh-ml-pipelines-api-server-v2-rhel9 1787173417, rhoai/odh-ml-pipelines-api-server-v2-rhel9 1791866195
    fixed: vendor fix RHSA-2026:84734
  • Red Hat AI Inference Server rhaii/vllm-cpu-rhel9, rhaii/vllm-tpu-rhel9, rhaii/vllm-cuda-rhel9, rhaii/vllm-rocm-rhel9, rhaiis/vllm-cpu-rhel9, rhaiis/vllm-tpu-rhel9, +7 more Red Hat OpenShift AI 2.25 rhoai/odh-rhel9-operator 1786112809, rhoai/odh-rhel9-operator 1788331391, rhoai/odh-vllm-cpu-rhel9 1786712073, rhoai/odh-dashboard-rhel9 1785940823, rhoai/odh-dashboard-rhel9 1788312226, rhoai/odh-modelmesh-rhel9 1788319539, +95 more Red Hat OpenShift AI 3.3 rhoai/odh-trainer-rhel9 1785187865, rhoai/odh-rhel9-operator 1786129846, rhoai/odh-dashboard-rhel9 1786109683, rhoai/odh-operator-bundle 1786130475, rhoai/odh-ta-lmes-job-rhel9 1785187607, rhoai/odh-mod-arch-maas-rhel9 1786109736, +21 more Red Hat OpenShift AI 3.4 rhoai/odh-cli-rhel9 1787330837, rhoai/odh-cli-rhel9 1791509689, rhoai/rhai-cli-rhel9 1787330837, rhoai/rhai-cli-rhel9 1791509689, rhoai/odh-automl-rhel9 1786612415, rhoai/odh-automl-rhel9 1791535789, +240 more
    not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation
none
Automatable
no
Technical impact
partial
Assessed
2mo ago

Exploit prediction

0.52% chance of exploitation in the next 30 days, higher than 44% of all scored CVEs (FIRST EPSS, 2026-11-09).

CVSS scores

assigned by version score vector
CNA 3.1 7.6 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L

Affected products

  • Red Hat Red Hat OpenShift AI 2.25
  • Red Hat Red Hat OpenShift AI 3.3
  • Red Hat Red Hat OpenShift AI 3.4
  • Red Hat Red Hat AI Inference Server

Classification

Weakness
  • CWE-266 Incorrect Privilege Assignment

References

Sources

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.