OpenShift AI Data Science Pipelines Operator: predictable PRNG generates MariaDB and MinIO credentials

Impact

The operator generates the MariaDB root and user passwords and the MinIO access and secret keys for pipeline storage using a cryptographically weak PRNG, so the values are predictable rather than random. Anyone who can reach the MinIO Route or the MariaDB Service can derive them without authenticating first, and the MinIO Route is frequently exposed beyond the cluster. What that buys is the pipeline object store and metadata database for every data science project on the cluster: training datasets, model artifacts, and run metadata from the jobs your GPUs actually spent their time on. Red Hat scores the impact as disclosure only (C:H/I:N/A:N), so treat the confirmed exposure as read access to artifacts and metadata rather than a documented tampering path.

Who can reach it

Unauthenticated, from anywhere that can reach the MinIO Route or the MariaDB Service - external for an exposed Route, any pod on the cluster network for the Service. No prior credential and no cluster foothold required.

What to do

Apply the Red Hat errata for your OpenShift AI stream (2.25, 3.3, 3.4 are listed); the update rolls the operator and its managed pods, which is a controlled restart of the pipelines stack rather than a node drain, and does not touch running GPU workloads. Note that patching the generator does not by itself replace credentials that were already generated weakly - after updating, rotate the MariaDB root and user passwords and the MinIO access and secret keys, and confirm the MinIO Route is not exposed more widely than it needs to be.

References

Related entries

• Ray Dashboard: Path traversal in the dashboard static-file handler (port 8265)CVE-2026-32981 · Ray DashboardHigh
• LangChain: prompt config files are loaded from unvalidated paths, letting a caller read arbitrary host filesCVE-2026-34070 · LangChain langchain-core prompt loading (load_prompt / load_prompt_from_config)High
• vLLM (activation function loading): Assert-based security check bypass, unauthenticatedCVE-2026-41523 · vLLM (activation function loading)High
• Spring AI: predictable ONNX model cache path lets a local user plant a substitute model fileCVE-2026-47852 · Spring AI (ONNX model cache path)High
• Ollama (quantization engine): Unauthenticated remote information disclosure — reads and exfiltrates model dataCVE-2026-5757 · Ollama (quantization engine)High
• NVIDIA NemoClaw for Linux: installer downloads code without an integrity checkCVE-2026-65097 · NVIDIA NemoClaw for Linux (installation scripts)High