CVE-2026-18621

Name of the Vulnerable Software and Affected Versions Data Science Pipelines (affected versions not specified)

Description An attacker with namespace editor privileges can bypass security hardening by submitting a malicious Argo Workflow through the 'V1 API' path. This issue allows the API server to act as a confused deputy—a legitimate entity manipulated into performing unauthorized actions—to create pods with elevated privileges. Successful exploitation grants the attacker node-root access, enabling arbitrary code execution and full control over the underlying node.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.