CVE-2026-18611
CVE-2026-18611 patches a credential generation flaw in the Data Science Pipelines Operator where Math.random() was used to create MariaDB root passwords and MinIO access keys. The vulnerability carries a 7.5 CVSS score, but that rating measures the wrong threat model. Exploiting the weak PRNG requires an attacker to first reach the MinIO Route or MariaDB Service — which means lateral movement, RBAC misconfiguration, or insider access has already occurred. The weak randomness is a post-breach multiplier, not a standalone entry point. The deeper problem is architectural. Kubernetes provides the Secret resource precisely to externalize credential creation to the platform's entropy sources. Operators that self-generate credentials during reconciliation loops are coupling credential lifecycle to operator lifecycle — a design choice that creates predictable output when developers reach for whatever PRNG is immediately available in the language runtime. This is not unique to this operator. The same fault line appeared in Docker Swarm secrets (2018, math/rand seeded from current time), Helm v2 templates (2019, rand package with seeded source), and kubectl cp (CVE-2019-1002100). Each recurrence uses a different PRNG in a different language; the constant is the reconciliation loop's moment of generation. This means patching one operator plays whack-a-mole. The fix that reduces blast radius is changing the operator SDK's code generation templates — the scaffolding new operators start from. One template fix prevents this class of failure across every operator built on that framework. Organizations should also prioritize RBAC hardening and network policies over PRNG patching, because the lateral movement path is what makes the weak credentials actionable. If the operator must generate credentials, audit the code for Math.random() or equivalent and replace with crypto/rand — but treat that as a defensive layer, not the primary remediation.
Reviewed through automated stages and approved by a human before publication.