Openshift Data Science

openshift_data_science

Vendor: Redhat • 4 CVEs

CVEs (4)

CVE VENDORS PRODUCTS UPDATED PUBLISHED CVSS
CVE-2024-7557 1Redhat 2Openshift Ai Openshift Data Science Jun 17, 2026 Aug 12, 2024 N/A· v4 8.8 HIGH· v3 N/A· v2 A vulnerability was found in OpenShift AI that allows for authentication bypass and privilege escalation across models within the same namespace. When deploying AI models, the UI provides the option to protect models wit...Show more A vulnerability was found in OpenShift AI that allows for authentication bypass and privilege escalation across models within the same namespace. When deploying AI models, the UI provides the option to protect models with authentication. However, credentials from one model can be used to access other models and APIs within the same namespace. The exposed ServiceAccount tokens, visible in the UI, can be utilized with oc --token={token} to exploit the elevated view privileges associated with the ServiceAccount, leading to unauthorized access to additional resources.Show less
CVE-2023-44487 33Akka AmazonApache+30 more 165.net 3scale Api Management PlatformAdvanced Cluster Management For Kubernetes+162 more Jun 17, 2026 Oct 10, 2023 N/A· v4 7.5 HIGH· v3 N/A· v2 The HTTP/2 protocol allows a denial of service (server resource consumption) because request cancellation can reset many streams quickly, as exploited in the wild in August through October 2023.
CVE-2023-3361 2Opendatahub Redhat 2Open Data Hub Dashboard Openshift Data Science Jun 17, 2026 Oct 4, 2023 N/A· v4 7.5 HIGH· v3 N/A· v2 A flaw was found in Red Hat OpenShift Data Science. When exporting a pipeline from the Elyra notebook pipeline editor as Python DSL or YAML, it reads S3 credentials from the cluster (ds pipeline server) and saves them in...Show more A flaw was found in Red Hat OpenShift Data Science. When exporting a pipeline from the Elyra notebook pipeline editor as Python DSL or YAML, it reads S3 credentials from the cluster (ds pipeline server) and saves them in plain text in the generated output instead of an ID for a Kubernetes secret.Show less
CVE-2023-0923 1Redhat 1Openshift Data Science Jun 17, 2026 Sep 15, 2023 N/A· v4 9.8 CRITICAL· v3 N/A· v2 A flaw was found in the Kubernetes service for notebooks in RHODS, where it does not prevent pods from other namespaces and applications from making requests to the Jupyter API. This flaw can lead to file content exposur...Show more A flaw was found in the Kubernetes service for notebooks in RHODS, where it does not prevent pods from other namespaces and applications from making requests to the Jupyter API. This flaw can lead to file content exposure and other issues.Show less