CVE-2026-18620

Name of the Vulnerable Software and Affected Versions Data Science Pipelines (affected versions not specified)

Description An improper authorization issue exists in the setDefaultServiceAccount() function. A restricted user or tenant can bypass authorization checks by specifying a more privileged ServiceAccount during a CreateRun request. This allows the attacker to run containers with elevated privileges, which may lead to the execution of commands within other users' pods and the disclosure of sensitive secrets.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.