CyberRota Analysis
AI-GeneratedA vulnerability in the Data Science Pipelines Operator allows unauthenticated attackers to exploit a weak pseudo-random number generator, enabling them to derive sensitive credentials like MariaDB and MinIO access keys. This could lead to unauthorized access to pipeline artifacts and metadata, posing a significant risk of information disclosure. Organizations utilizing this operator should prioritize remediation to safeguard their data and infrastructure.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
A flaw was found in the Data Science Pipelines Operator. This vulnerability allows an unauthenticated attacker to derive sensitive credentials, such as MariaDB root/user passwords and MinIO access/secret keys, if they can access the MinIO Route or MariaDB Service. The flaw occurs because the operator uses a cryptographically weak pseudo-random number generator (PRNG) to generate these credentials, making them predictable. Successful exploitation could lead to unauthorized access to all pipeline artifacts and metadata, resulting in significant information disclosure.