OpenShift AI Data Science Pipelines Operator: over-broad ClusterRole turns operator compromise into cluster admin

Impact

The Data Science Pipelines Operator ships a ClusterRole with privileges well beyond what it needs, including pod exec and cluster-wide role management. On a GPU cluster running OpenShift AI, that operator sits alongside the tenant workloads it schedules, so anyone who compromises the DSPO pod - through a pipeline component, a malicious image, or a chained flaw in the operator itself - inherits full administrative control of the cluster. Pod exec across namespaces means reaching into other tenants' training and inference pods on shared GPU nodes; cluster-wide role management means making that access permanent. The blast radius is the whole fleet, not the one node the operator happened to run on.

Who can reach it

An attacker who has already achieved code execution in the DSPO pod, or who holds credentials able to influence what that pod runs. Not directly reachable unauthenticated - Red Hat scores it PR:H - but the consequence of any operator-level foothold is escalated to cluster admin.

What to do

Apply the Red Hat errata for your OpenShift AI stream (RHSA-2026:53261 / 53262 / 53263 for 2.25 and 3.3/3.4 lines, RHSA-2026:60520). The fix is an operator update, so the operator pod is rolled and pipeline controllers restart; tenant GPU workloads are not evicted and no node drain or reboot is required. Until patched, audit who can reach the DSPO namespace and restrict what can be scheduled into it.

References

Related entries

• Istio: When JWKS resolution fails, istiod falls back to hardcoded defaults, weakening JWT validationCVE-2026-31837 · IstioHigh
• Docker MCP Gateway: OCI image label controls run arguments, allowing host mounts and UID 0CVE-2026-55887 · Docker MCP Gateway (io.docker.server.metadata OCI label -> docker run arguments)High
• Firecracker: Out-of-bounds write in the virtio PCI transportCVE-2026-5747 · FirecrackerHigh
• Red Hat ACM lighthouse: unvalidated EndpointSlice IPs let a spoke cluster hijack cross-cluster service trafficCVE-2026-66787 · Red Hat Advanced Cluster Management lighthouse (cross-cluster service DNS)High
• Dockge: authenticated user reads or deletes arbitrary host directories via stack-name traversalCVE-2026-73040 · Dockge (Docker Compose stack manager, stack-name path traversal)High
• NGINX Ingress Controller: unsanitized Ingress annotations inject arbitrary NGINX directivesCVE-2026-77180 · NGINX Ingress Controller (Ingress annotation to nginx.conf generator)High