CVE-2026-18621highCWE-266

CVE-2026-18621: falha de alta gravidade em Red Hat AI Inference Server

Data-sciences-pipeline: dsp: v1 argo template path accepts arbitrary workflow spec, bypassing all v2 security hardening

Publicada em · Atualizada em

Seguir esta CVE+ Monitorar Red Hat OpenShift AI+ Monitorar Red Hat AI Inference Server

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

21Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 7.6epss 0.5%
A flaw was found in Data Science Pipelines (DSP). An attacker with namespace editor privileges can bypass security hardening by submitting a malicious Argo Workflow through the V1 API path. This allows the API server to create pods with elevated privileges, acting as a 'confused deputy' on behalf of the attacker. Successful exploitation grants the attacker node-root access, enabling arbitrary code execution and full control over the underlying node.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L
Produtos afetados
Red Hat · Red Hat AI Inference ServerRed Hat · Red Hat OpenShift AI 2.25Red Hat · Red Hat OpenShift AI 3.3Red Hat · Red Hat OpenShift AI 3.4
CVEs relacionadas — Red Hat AI Inference Server

No mesmo produto, das mais perigosas para as menos.

CVE-2026-18948CRITICALFeast: feast: unsafe dill deserialization of registry-stored udfs — rce on feature server and registry serverEPSS 1.1%CVE-2026-18951HIGHOdh-training-operator-rhel9: [trainer v2 security] trn-02: rhoai overlay aggregates trainjobs crud into standard edit clusterroleEPSS 0.9%CVE-2026-18941HIGHFeast: feast-operator: feast: default authentication mode is no_auth — shared multi-tenant instances deployed without authenticationEPSS 0.9%CVE-2026-56211HIGHLibaom: libaom: remote code execution via svc layer context handling with attacker-controlled framesEPSS 0.9%CVE-2026-18618HIGHMl-metdata: bundled grpc 1.46.3 (2022) with published http/2 dos cves — directly reachable on listenerEPSS 0.8%CVE-2026-18982HIGHOdh-training-operator-rhel9: rhoai fork aggregates training job create onto native edit/admin clusterrolesEPSS 0.8%