CVE-2026-18611 — Data-science-pipelines-operator: dspo: cryptographically weak secret generation (math/rand) for db and s3 credentials
A flaw was found in the Data Science Pipelines Operator. This vulnerability allows an unauthenticated attacker to derive sensitive credentials, such as MariaDB root/user passwor…
Published: 2026-08-10 · CVSS: 7.5 · CVSS 3.1
A flaw was found in the Data Science Pipelines Operator. This vulnerability allows an unauthenticated attacker to derive sensitive credentials, such as MariaDB root/user passwords and MinIO access/secret keys, if they can access the MinIO Route or MariaDB Service. The flaw occurs because the operator uses a cryptographically weak pseudo-random number generator (PRNG) to generate these credentials, making them predictable. Successful exploitation could lead to unauthorized access to all pipeline artifacts and metadata, resulting in significant information disclosure.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7