Description

A flaw was found in the Data Science Pipelines Operator (DSPO). A namespace editor can exploit a vulnerability in the spec.database.customExtraParams field, which allows for the injection of dangerous parameters into the MySQL Data Source Name (DSN) string. By manipulating these parameters, an attacker can enable LOCAL INFILE functionality and exfiltrate sensitive files, such as the service account token, from the operator pod. This can lead to privilege escalation, allowing a namespace editor to gain cluster-admin privileges.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.8",
  "pubDate": "2026-08-10T21:17:20.250Z",
  "pubdate": "2026-08-10T21:17:20.250Z",
  "executiveSummary": "A parameter injection vulnerability exists in the Data Science Pipelines Operator (DSPO) affecting the database configuration component. The flaw arises from improper sanitization of user-supplied input within the spec.database.customExtraParams field, which is directly concatenated into the MySQL Data Source Name (DSN) string. This security deficiency allows a low-privileged user with namespace editor permissions to inject arbitrary and potentially dangerous parameters into the database connection string.\nSuccessful exploitation of this vulnerability enables a malicious namespace editor to manipulate the MySQL client configuration, specifically by enabling the LOCAL INFILE functionality. By forcing the database connection to permit local file transfers, an attacker can coerce the operator pod into reading and exfiltrating sensitive files, such as the service account token mounted within the container.\nThe compromise of the operator pod service account token introduces severe risk implications, directly facilitating privilege escalation across the Kubernetes cluster. With the elevated permissions typically granted to operator service accounts, an attacker can transition from a localized namespace editor role to gaining cluster-admin privileges, thereby compromising the entire cluster infrastructure and all hosted workloads.",
  "technicalDetails": "The root cause of the vulnerability resides in the insufficient input validation and improper sanitization mechanisms implemented within the Data Science Pipelines Operator (DSPO). Specifically, the vulnerable component processes the spec.database.customExtraParams field by directly appending or interpolating user-provided key-value pairs into the MySQL Data Source Name (DSN) connection string without adequately restricting administrative or connection-level parameters.\nThe exploitation method requires an attacker to possess namespace editor privileges, granting them the ability to modify custom resource definitions or configuration specifications managed by DSPO. The attack flow begins when the malicious actor crafts a custom resource containing specially engineered payloads within the spec.database.customExtraParams field. When the DSPO processes this specification, it establishes a MySQL database connection using the malformed DSN string containing the injected parameters.\nBy injecting specific configuration directives, such as enabling the client-side allowAllClientsLocalInfile or equivalent parameter within the DSN string, the attacker alters the default secure behavior of the database driver. Once the connection is established, the attacker leverages the server-side or client-side capabilities to execute malicious database queries, such as LOAD DATA LOCAL INFILE, directed against resources accessible to the operator pod.\nThis payload behavior forces the MySQL client library running inside the operator pod to read local files from the container's filesystem and transmit the contents back to a database server under the attacker's control. The primary targets of this exfiltration technique include sensitive credentials, most notably the Kubernetes service account token located at the standard default mount path within the operator pod.\nThe post-exploitation impact is critical. Upon successfully exfiltrating the service account token associated with the Data Science Pipelines Operator, the attacker utilizes these high-privilege credentials to authenticate directly against the Kubernetes API server. Because operators often possess broad cluster-level permissions to manage resources, deployment states, and cluster components, the stolen token allows the attacker to achieve full privilege escalation and acquire cluster-admin privileges, compromising multi-tenant isolation and cluster integrity."
}