Nixpkgs security tracker
Dismissed
(no matching packages found)
Permalink
CVE-2026-18621
7.6 HIGH
- CVSS version (CVSS): 3.1
- Attack Vector (AV): Network (N)
- Attack Complexity (AC): Low (L)
- Privileges Required (PR): Low (L)
- User Interaction (UI): None (N)
- Scope (S): Unchanged (U)
- Confidentiality (C): High (H)
- Integrity (I): Low (L)
- Availability (A): Low (L)
- Modified Attack Vector (MAV): Network (N)
- Modified Attack Complexity (MAC): Low (L)
- Modified Privileges Required (MPR): Low (L)
- Modified User Interaction (MUI): None (N)
- Modified Confidentiality (MC): High (H)
- Modified Scope (MS): Unchanged (U)
- Modified Integrity (MI): Low (L)
- Modified Availability (MA): Low (L)
Activity log
- Created & dismissed (no matching packages found) suggestion
Data-sciences-pipeline: dsp: v1 argo template path accepts arbitrary workflow spec, bypassing all v2 security hardening
A flaw was found in Data Science Pipelines (DSP). An attacker with namespace editor privileges can bypass security hardening by submitting a malicious Argo Workflow through the V1 API path. This allows the API server to create pods with elevated privileges, acting as a 'confused deputy' on behalf of the attacker. Successful exploitation grants the attacker node-root access, enabling arbitrary code execution and full control over the underlying node.
References
Affected products
rhaii/vllm-cpu-rhel9
rhaii/vllm-tpu-rhel9
rhaii/vllm-cuda-rhel9
rhaii/vllm-rocm-rhel9
rhaiis/vllm-cpu-rhel9
rhaiis/vllm-tpu-rhel9
rhaii/vllm-gaudi-rhel9
rhaii/vllm-spyre-rhel9
rhaiis/vllm-cuda-rhel9
rhaiis/vllm-rocm-rhel9
rhaii/vllm-neuron-rhel9
rhaiis/vllm-spyre-rhel9
rhaiis/vllm-neuron-rhel9
rhoai/odh-ml-pipelines-api-server-v2-rhel9