CVE-2026-18621: vLLM confused deputy grants node-root

CISO Take

This flaw lets a user who already holds namespace-editor privileges in Red Hat OpenShift AI submit a crafted Argo Workflow through the Data Science Pipelines V1 API, tricking the API server into creating pods with elevated privileges on its behalf — a textbook confused-deputy bug that ends in full node-root access and arbitrary code execution. It matters because Data Science Pipelines sits at the heart of multi-tenant ML training and serving environments where 128 downstream components depend on the platform staying isolated between tenants; a single low-privileged account can pivot to owning the underlying node and everything else scheduled on it. The likelihood signals are currently low — EPSS sits at just 0.35% (top 72nd percentile), there's no public exploit or Nuclei template, it's not in CISA's KEV catalog, and CISA's own SSVC decision is TRACK rather than an urgent ACT/ATTEND — but the CVSS 7.6 and PR:L/AV:N profile mean any authenticated namespace editor, including a compromised CI/CD service account, can trigger it with no user interaction. Patch via the corresponding Red Hat errata (RHSA-2026:53261/53262/53263) for the affected OpenShift AI and Red Hat AI Inference Server images, and in the meantime tighten namespace-editor RBAC grants and audit Argo Workflow submissions for pod specs requesting elevated securityContext or hostPath mounts.

Sources: NVD EPSS CISA SSVC access.redhat.com ATLAS

What is the risk?

High-severity (CVSS 7.6) but currently low-urgency from an exploitation-likelihood standpoint: EPSS is only 0.35% (top 72nd percentile, not high), there is no public exploit code or Nuclei scanner coverage, and CISA's SSVC decision is TRACK. The real risk driver is the privilege model — exploitation requires only namespace-editor rights, a role commonly granted to data scientists, ML engineers, or automated pipeline service accounts in shared OpenShift AI clusters, which is a much lower bar than cluster-admin. Because the outcome is node-root and container escape rather than a contained data leak, any successful exploitation converts a routine internal account compromise into full infrastructure compromise, making this a priority patch item for any multi-tenant AI platform even without active exploitation in the wild.

How does the attack unfold?

Initial Access

Attacker obtains or already holds namespace-editor privileges in an OpenShift AI cluster, e.g. via a compromised data-scientist or CI/CD service account.

AML.T0012

Exploitation

Attacker submits a malicious Argo Workflow manifest requesting elevated pod privileges through the Data Science Pipelines V1 API, bypassing the hardening normally applied to direct Argo submissions.

AML.T0107

Privilege Escalation

The DSP API server, acting as a confused deputy, creates the pod with the requested elevated privileges and the attacker escapes the container to the underlying node.

AML.T0105

Impact

Attacker achieves node-root access and arbitrary code execution, enabling lateral movement into other training or inference workloads sharing the compromised node.

Initial Access

Attacker obtains or already holds namespace-editor privileges in an OpenShift AI cluster, e.g. via a compromised data-scientist or CI/CD service account.

AML.T0012

Exploitation

Attacker submits a malicious Argo Workflow manifest requesting elevated pod privileges through the Data Science Pipelines V1 API, bypassing the hardening normally applied to direct Argo submissions.

AML.T0107

Privilege Escalation

The DSP API server, acting as a confused deputy, creates the pod with the requested elevated privileges and the attacker escapes the container to the underlying node.

AML.T0105

Impact

Attacker achieves node-root access and arbitrary code execution, enabling lateral movement into other training or inference workloads sharing the compromised node.

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
vLLM	pip	—	No patch
92.7K 95 dependents Pushed 5d ago 26% patched ~47d to patch Full package profile →
vLLM	pip	—	No patch
92.7K 95 dependents Pushed 5d ago 26% patched ~47d to patch Full package profile →
vLLM	pip	—	No patch
92.7K 95 dependents Pushed 5d ago 26% patched ~47d to patch Full package profile →
vLLM	pip	—	No patch
92.7K 95 dependents Pushed 5d ago 26% patched ~47d to patch Full package profile →
vLLM	pip	—	No patch
92.7K 95 dependents Pushed 5d ago 26% patched ~47d to patch Full package profile →
vLLM	pip	—	No patch
92.7K 95 dependents Pushed 5d ago 26% patched ~47d to patch Full package profile →
vLLM	pip	—	No patch
92.7K 95 dependents Pushed 5d ago 26% patched ~47d to patch Full package profile →
vLLM	pip	—	No patch
92.7K 95 dependents Pushed 5d ago 26% patched ~47d to patch Full package profile →
vLLM	pip	—	No patch
92.7K 95 dependents Pushed 5d ago 26% patched ~47d to patch Full package profile →
vLLM	pip	—	No patch
92.7K 95 dependents Pushed 5d ago 26% patched ~47d to patch Full package profile →
vLLM	pip	—	No patch
92.7K 95 dependents Pushed 5d ago 26% patched ~47d to patch Full package profile →
vLLM	pip	—	No patch
92.7K 95 dependents Pushed 5d ago 26% patched ~47d to patch Full package profile →
vLLM	pip	—	No patch
92.7K 95 dependents Pushed 5d ago 26% patched ~47d to patch Full package profile →
rhoai/odh-ml-pipelines-api-server-v2-rhel9	—	—	No patch

How severe is it?

CVSS 3.1

7.6 / 10

EPSS

0.5%

chance of exploitation in 30 days

Higher than 41% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

No known exploitation

Sophistication

Moderate

What is the attack surface?

AV Network

AC Low

PR Low

UI None

S Unchanged

C High

I Low

A Low

What should I do?

1 step

Patch to the fixed builds referenced in RHSA-2026:53261, RHSA-2026:53262, and RHSA-2026:53263 for affected OpenShift AI / Red Hat AI Inference Server images as soon as they're validated in staging. Until patched, restrict and audit who holds namespace-editor role bindings in OpenShift AI projects — treat it as a high-privilege grant, not a default developer role. Enable admission control (e.g., Pod Security Admission at the 'restricted' profile) to block pods requesting privileged securityContext, hostPath mounts, or host namespaces regardless of the submitting service account. For detection, alert on Argo Workflow or pipeline-run submissions that result in pod creation with elevated securityContext, non-default serviceAccounts, or host-level mounts, and review Data Science Pipelines API server audit logs for V1 API workflow submissions from non-admin identities.

What does CISA's SSVC say?

Decision Track

Exploitation none

Automatable No

Technical Impact partial

Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.

How is it classified?

Auth Bypass Code Execution Framework API AML.T0012 - Valid Accounts AML.T0105 - Escape to Host AML.T0107 - Exploitation for Defense Evasion

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Article 15 - Accuracy, robustness and cybersecurity

ISO 42001

A.6.2 / 8.2 - AI system operational security and change control

NIST AI RMF

MEASURE 2.7 - AI system security and resilience are evaluated and documented

Frequently Asked Questions

What is CVE-2026-18621?

This flaw lets a user who already holds namespace-editor privileges in Red Hat OpenShift AI submit a crafted Argo Workflow through the Data Science Pipelines V1 API, tricking the API server into creating pods with elevated privileges on its behalf — a textbook confused-deputy bug that ends in full node-root access and arbitrary code execution. It matters because Data Science Pipelines sits at the heart of multi-tenant ML training and serving environments where 128 downstream components depend on the platform staying isolated between tenants; a single low-privileged account can pivot to owning the underlying node and everything else scheduled on it. The likelihood signals are currently low — EPSS sits at just 0.35% (top 72nd percentile), there's no public exploit or Nuclei template, it's not in CISA's KEV catalog, and CISA's own SSVC decision is TRACK rather than an urgent ACT/ATTEND — but the CVSS 7.6 and PR:L/AV:N profile mean any authenticated namespace editor, including a compromised CI/CD service account, can trigger it with no user interaction. Patch via the corresponding Red Hat errata (RHSA-2026:53261/53262/53263) for the affected OpenShift AI and Red Hat AI Inference Server images, and in the meantime tighten namespace-editor RBAC grants and audit Argo Workflow submissions for pod specs requesting elevated securityContext or hostPath mounts.

Is CVE-2026-18621 actively exploited?

No confirmed active exploitation of CVE-2026-18621 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-18621?

Patch to the fixed builds referenced in RHSA-2026:53261, RHSA-2026:53262, and RHSA-2026:53263 for affected OpenShift AI / Red Hat AI Inference Server images as soon as they're validated in staging. Until patched, restrict and audit who holds namespace-editor role bindings in OpenShift AI projects — treat it as a high-privilege grant, not a default developer role. Enable admission control (e.g., Pod Security Admission at the 'restricted' profile) to block pods requesting privileged securityContext, hostPath mounts, or host namespaces regardless of the submitting service account. For detection, alert on Argo Workflow or pipeline-run submissions that result in pod creation with elevated securityContext, non-default serviceAccounts, or host-level mounts, and review Data Science Pipelines API server audit logs for V1 API workflow submissions from non-admin identities.

What systems are affected by CVE-2026-18621?

This vulnerability affects the following AI/ML architecture patterns: training pipelines, model serving.

What is the CVSS score for CVE-2026-18621?

CVE-2026-18621 has a CVSS v3.1 base score of 7.6 (HIGH). The EPSS exploitation probability is 0.51%.

What is the AI security impact?

Affected AI Architectures

training pipelinesmodel serving

MITRE ATLAS Techniques

AML.T0012 Valid Accounts

AML.T0105 Escape to Host

AML.T0107 Exploitation for Defense Evasion

Compliance Controls Affected

EU AI Act: Article 15

ISO 42001: A.6.2 / 8.2

NIST AI RMF: MEASURE 2.7

What are the technical details?

Original Advisory

A flaw was found in Data Science Pipelines (DSP). An attacker with namespace editor privileges can bypass security hardening by submitting a malicious Argo Workflow through the V1 API path. This allows the API server to create pods with elevated privileges, acting as a 'confused deputy' on behalf of the attacker. Successful exploitation grants the attacker node-root access, enabling arbitrary code execution and full control over the underlying node.

Exploitation Scenario

An attacker who has compromised or legitimately holds a namespace-editor account in an OpenShift AI cluster — for example a data scientist's credentials or a CI/CD service account used to submit training jobs — crafts an Argo Workflow manifest requesting a pod with privileged securityContext or a hostPath volume mount, and submits it through the Data Science Pipelines V1 API rather than directly to Argo. Because DSP acts as the deputy that creates the underlying pod on the attacker's behalf, the security hardening normally applied to direct Argo submissions is bypassed, and the API server creates the pod with the requested elevated privileges. The attacker's pod then escapes its container boundary to the host, gaining node-root access, arbitrary code execution on the node, and a foothold to pivot into other AI workloads — training jobs, model-serving pods, or other tenants' pipelines — scheduled on the same shared infrastructure.

Weaknesses (CWE)

CWE-266 Incorrect Privilege Assignment

CWE-266 — Incorrect Privilege Assignment: A product incorrectly assigns a privilege to a particular actor, creating an unintended sphere of control for that actor.

[Architecture and Design, Operation] Very carefully manage the setting, management, and handling of privileges. Explicitly manage trust zones in the software.
[Architecture and Design, Operation] Run your code using the lowest privileges that are required to accomplish the necessary tasks [REF-76]. If possible, create isolated accounts with limited privileges that are only used for a single task. That way, a successful attack will not immediately give the attacker access to the rest of the software or its environment. For example, database applications rarely need to run as the database administrator, especially in day-to-day operations.

Source: MITRE CWE corpus.