A flaw in Red Hat OpenShift AI (RHOAI) and Data Science Pipelines Operator (DSPO) allows namespace editors to escalate privileges to node-root by exploiting the V1 Argo template API path. This path bypasses the security hardening enforced by the V2 compiler, enabling the API server to act as a confused deputy and create privileged pods in namespaces configured with GPU operators or privileged Security Context Constraints (SCCs). Successful exploitation grants full control over the node, including arbitrary code execution. The vulnerability is tracked as CVE-2026-18621 with a CVSS 3.1 score of 7.6 (high severity).

An attacker with namespace editor privileges can escalate to node-root privileges, gaining full control over the underlying node. This includes the ability to execute arbitrary code with elevated privileges, potentially compromising the entire node and any workloads running on it. The vulnerability affects namespaces configured with GPU operators or privileged SCCs and leverages a confused deputy scenario in the API server.

To mitigate this vulnerability, enforce the Kubernetes pod security policy annotation `pod-security.kubernetes.io/enforce: restricted` on Data Science Project namespaces. Additionally, verify that the `pipeline-runner` ServiceAccount is not bound to privileged or anyuid Security Context Constraints (SCCs). These mitigations reduce the risk by preventing privileged pod creation through the vulnerable API path. Patch status is not confirmed; check the Red Hat advisory at https://access.redhat.com/security/cve/CVE-2026-18621 for updates on official fixes.