Veille CVE

‹ Retour à la liste

CVE-2026-18608

8.7 Élevée

Publiée le 10/08/2026 à 23:17 · Modifiée le 21/09/2026 à 13:17 · En attente d'analyse NVD · Source : secalert@redhat.com

Description

A flaw was found in the Data Science Pipelines Operator (DSPO). The operator's ClusterRole, which defines its permissions, includes extensive privileges beyond what is necessary for its operation. These excessive permissions, such as the ability to execute commands within pods and manage cluster-wide roles, could be exploited. If the DSPO pod were compromised, an attacker could leverage these privileges to gain full administrative control over the entire Kubernetes cluster.

Traduire en français

Produits concernés

Scores CVSS

VersionScoreSourceVecteur
3.1 8.7 Élevée secalert@redhat.com CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:N

Faiblesses (CWE)

Références

Ailleurs