CVE-2026-18611 is a vulnerability in the Data Science Pipelines Operator where a cryptographically weak pseudo-random number generator is used to generate sensitive credentials. This weakness allows an unauthenticated attacker who can access the MinIO Route or MariaDB Service to predict and derive credentials such as MariaDB root/user passwords and MinIO access/secret keys. Exploitation could result in unauthorized access to all pipeline artifacts and metadata, causing significant information disclosure. The vulnerability has a CVSS 3.1 base score of 7.5 (High) with network attack vector, low attack complexity, no privileges required, no user interaction, and high confidentiality impact. Red Hat advisories acknowledge the issue but currently list no fixes for affected versions, recommending users to follow upgrade instructions when updates become available.

Successful exploitation allows unauthenticated attackers to predict and obtain sensitive credentials for MariaDB and MinIO services used by the Data Science Pipelines Operator. This leads to unauthorized access to pipeline artifacts and metadata, resulting in significant information disclosure. The vulnerability does not affect integrity or availability directly but poses a high confidentiality risk.

Currently, no official fix is available for this vulnerability as per the Red Hat advisories. Users should closely follow Red Hat's documentation and upgrade instructions for Red Hat OpenShift AI when updated images or patches are released. Until a fix is provided, restrict access to the MinIO Route and MariaDB Service to trusted users only to reduce exposure. Monitor Red Hat security advisories for updates and apply patches promptly once available.