Description

A flaw was found in Data Science Pipelines (DSP). An attacker with namespace editor privileges can bypass security hardening by submitting a malicious Argo Workflow through the V1 API path. This allows the API server to create pods with elevated privileges, acting as a 'confused deputy' on behalf of the attacker. Successful exploitation grants the attacker node-root access, enabling arbitrary code execution and full control over the underlying node.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.6",
  "pubDate": "2026-08-10T21:17:20.617Z",
  "pubdate": "2026-08-10T21:17:20.617Z",
  "executiveSummary": "A privilege escalation vulnerability has been identified in Data Science Pipelines (DSP). This security flaw stems from a confused deputy scenario occurring within the V1 API path, where inadequate validation allows authenticated users with restricted permissions to submit maliciously crafted definitions.\nThe vulnerability allows an attacker possessing namespace editor privileges to bypass existing security hardening mechanisms. By submitting a specially crafted Argo Workflow through the vulnerable V1 API path, the API server is induced to process and create pods operating with elevated privileges on behalf of the user.\nSuccessful exploitation of this flaw grants the attacker node-root access to the underlying cluster node. This level of access results in arbitrary code execution and grants the attacker full administrative control over the affected node, severely compromising the integrity and confidentiality of the entire cluster environment.\nPrerequisites for this attack include authenticated access to the Data Science Pipelines service and possession of namespace editor privileges. Organizations utilizing Data Science Pipelines are at high risk if unmitigated, as internal privilege boundaries can be completely bypassed by compromised or malicious accounts holding standard administrative roles within a specific namespace.",
  "technicalDetails": "The root cause of this vulnerability lies in insufficient input sanitization and authorization enforcement within the Data Science Pipelines (DSP) V1 API path when processing workflow submissions. The API server fails to adequately validate the structural components and security contexts of submitted Argo Workflows.\nThe vulnerable component is the API server handling workflow creation requests via the V1 API path. Because the API server executes with high privileges relative to standard user accounts, it acts as a confused deputy. It takes instructions from an attacker with namespace editor privileges and translates those instructions into privileged Kubernetes pod creations that the user would not normally be permitted to spawn directly.\nThe attack flow proceeds as follows: First, an attacker authenticates to the Data Science Pipelines service using credentials that confer namespace editor privileges. Second, the attacker constructs a malicious Argo Workflow payload designed to request elevated security contexts, such as host network access, privileged container execution, or mounting sensitive host directories. Third, the attacker submits this payload to the V1 API path. Fourth, the API server processes the request without sufficient restrictions, passing the privileged workflow configuration to the underlying container orchestration engine. Fifth, the orchestration engine spins up the resulting pods with elevated privileges.\nUpon successful pod deployment with elevated privileges, the payload behavior enables the attacker to break out of the container isolation boundary. Utilizing the elevated privileges granted to the pod, the attacker gains node-root access. Post-exploitation impact includes arbitrary code execution on the host operating system, unauthorized access to sensitive data stored on the node, potential lateral movement across the cluster, and total administrative control over the underlying node."
}