CVE-2026-18611 describes a vulnerability in the Data Science Pipelines Operator component of Red Hat OpenShift AI (RHOAI). The operator uses a cryptographically weak PRNG to generate credentials for MariaDB and MinIO, making these credentials predictable. An unauthenticated attacker who can access the MinIO Route or MariaDB Service may derive these credentials, leading to unauthorized access to pipeline artifacts and metadata. The vulnerability is especially risky if MinIO is exposed via a public OpenShift Route or if MariaDB is configured with empty root passwords. The weakness is due to the use of a non-cryptographically secure PRNG (math/rand) for secret generation.

Successful exploitation allows an unauthenticated attacker to obtain sensitive credentials such as MariaDB root/user passwords and MinIO access/secret keys. This leads to unauthorized access to all pipeline artifacts and metadata, resulting in significant confidentiality loss. The vulnerability does not impact integrity or availability. The risk is elevated in deployments with publicly exposed MinIO Routes or weak MariaDB root password configurations.

Users should explicitly provide strong, cryptographically secure credentials for MariaDB and MinIO when deploying the Data Science Pipelines Operator. Network access to MinIO and MariaDB services should be restricted using OpenShift NetworkPolicies to limit exposure. Avoid exposing MinIO via public OpenShift Routes unless absolutely necessary and ensure MariaDB is not configured with an empty root password. No official patch or fix is currently confirmed; check the Red Hat advisory for updates.