Search: science.more

A flaw was found in Data Science Pipelines. A restricted user, or tenant, can exploit an improper authorization vulnerability in the setDefaultServiceAccount function. By specifying a more privileged ServiceAccount (SA) during a CreateRun request, an attacker can bypass authorization checks. This allows the tenant to run their containers with elevated privileges, potentially leading to the disclosure of sensitive information (secrets) and the ability to execute commands within other users' pods.

CVE-2025-71003 is a high-severity input validation vulnerability in the flow.arange() component of OneFlow v0.9.0 that allows remote attackers to cause a Denial of Service (DoS) without authentication or user interaction. The flaw arises from improper input validation, enabling crafted inputs to crash or hang the application, impacting availability. There are no known exploits in the wild yet, and no patches have been published. European organizations using OneFlow for machine learning or data processing workloads could face service disruptions if targeted. Mitigation involves restricting access to OneFlow services, input sanitization, and monitoring for anomalous usage patterns. Countries with significant AI and data science sectors, such as Germany, France, and the UK, are more likely to be affected due to higher adoption rates of such frameworks. The vulnerability has a CVSS score of 7.

EPSS 0.4%VulnerabilityCWE-20Germany+2

CVE-2025-71002 is a medium-severity vulnerability in OneFlow v0.9.0's flow.column_stack component, where a crafted input triggers a floating-point exception causing a denial of service (DoS). The vulnerability requires no privileges but does require user interaction and can be exploited remotely over the network. It impacts availability without affecting confidentiality or integrity. No known exploits are currently in the wild, and no patches have been published yet. European organizations using OneFlow for machine learning or data processing may experience service disruptions if targeted. Mitigation involves input validation, restricting access to vulnerable components, and monitoring for anomalous inputs. Countries with strong AI and data science sectors, such as Germany, France, and the UK, are more likely to be affected.

EPSS 0.3%VulnerabilityCWE-369Germany+2