CVE-2026-18620 — Data-sciences-pipeline: user-controlled serviceaccount for workflow pods without authorization check — confused deputy
A flaw was found in Data Science Pipelines. A restricted user, or tenant, can exploit an improper authorization vulnerability in the setDefaultServiceAccount function. By specif…
Published: 2026-08-10 · CVSS: 7.1 · CVSS 3.1
A flaw was found in Data Science Pipelines. A restricted user, or tenant, can exploit an improper authorization vulnerability in the setDefaultServiceAccount function. By specifying a more privileged ServiceAccount (SA) during a CreateRun request, an attacker can bypass authorization checks. This allows the tenant to run their containers with elevated privileges, potentially leading to the disclosure of sensitive information (secrets) and the ability to execute commands within other users' pods.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7