CyberRota Analysis
AI-GeneratedA vulnerability in Data Science Pipelines allows restricted users to exploit improper authorization in the setDefaultServiceAccount function. By specifying a more privileged ServiceAccount during a CreateRun request, an attacker can bypass authorization checks, leading to elevated privileges that may result in the disclosure of sensitive information and unauthorized command execution within other users' pods. Organizations utilizing Data Science Pipelines should prioritize remediation to mitigate potential risks associated with this flaw.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
A flaw was found in Data Science Pipelines. A restricted user, or tenant, can exploit an improper authorization vulnerability in the setDefaultServiceAccount function. By specifying a more privileged ServiceAccount (SA) during a CreateRun request, an attacker can bypass authorization checks. This allows the tenant to run their containers with elevated privileges, potentially leading to the disclosure of sensitive information (secrets) and the ability to execute commands within other users' pods.