OpenShift AI Data Science Pipelines Operator: over-broad ClusterRole turns operator compromise into cluster admin

Impact

The Data Science Pipelines Operator ships a ClusterRole with privileges well beyond what it needs, including pod exec and cluster-wide role management. On a GPU cluster running OpenShift AI, that operator sits alongside the tenant workloads it schedules, so anyone who compromises the DSPO pod - through a pipeline component, a malicious image, or a chained flaw in the operator itself - inherits full administrative control of the cluster. Pod exec across namespaces means reaching into other tenants' training and inference pods on shared GPU nodes; cluster-wide role management means making that access permanent. The blast radius is the whole fleet, not the one node the operator happened to run on.

Who can reach it

An attacker who has already achieved code execution in the DSPO pod, or who holds credentials able to influence what that pod runs. Not directly reachable unauthenticated - Red Hat scores it PR:H - but the consequence of any operator-level foothold is escalated to cluster admin.

What to do

Apply the Red Hat errata for your OpenShift AI stream (RHSA-2026:53261 / 53262 / 53263 for 2.25 and 3.3/3.4 lines, RHSA-2026:60520). The fix is an operator update, so the operator pod is rolled and pipeline controllers restart; tenant GPU workloads are not evicted and no node drain or reboot is required. Until patched, audit who can reach the DSPO namespace and restrict what can be scheduled into it.

References

Related entries

• Istio: When JWKS resolution fails, istiod falls back to hardcoded defaults, weakening JWT validationCVE-2026-31837 · IstioHigh
• Firecracker: Out-of-bounds write in the virtio PCI transportCVE-2026-5747 · FirecrackerHigh
• Red Hat ACM lighthouse: unvalidated EndpointSlice IPs let a spoke cluster hijack cross-cluster service trafficCVE-2026-66787 · Red Hat Advanced Cluster Management lighthouse (cross-cluster service DNS)High
• runc: Host runc binary overwritten from inside a containerCVE-2019-5736 · runcHigh
• Envoy: ext-authz header handling flaw allows bypassing the external authorization serviceCVE-2021-32777 · EnvoyHigh
• Envoy: URI fragment treated as part of the pathCVE-2021-32779 · EnvoyHigh