HIGH 7.1 NVD
CVE-2026-18620
A flaw was found in Data Science Pipelines. A restricted user, or tenant, can exploit an improper authorization vulnerability in the setDefaultServiceAccount fu
A flaw was found in Data Science Pipelines. A restricted user, or tenant, can exploit an improper authorization vulnerability in the setDefaultServiceAccount function. By specifying a more privileged ServiceAccount (SA) during a CreateRun request, an attacker can bypass authorization checks. This allows the tenant to run their containers with elevated privileges, potentially leading to the disclosure of sensitive information (secrets) and the ability to execute commands within other users' pods.
References
- https://access.redhat.com/security/cve/CVE-2026-18620
- https://bugzilla.redhat.com/show_bug.cgi?id=2510320
This high severity vulnerability with a CVSS score of 7.1 was published on 2026-08-10 via NVD.
vulnfeed aggregates 7836 vulnerabilities from NVD, CISA KEV,
Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.