CVE-2026-18949 PUBLISHED

Odh-dashboard: odh-dashboard: clusterrole grants cluster-wide crud on secrets and rbac management resources

Assigner: redhat
Reserved: 05.08.2026 Published: 10.08.2026 Updated: 11.08.2026

A flaw was found in odh-dashboard. This vulnerability allows an attacker, who has compromised the dashboard's Service Account (SA) token, to exploit overly broad permissions granted to the SA. This enables the attacker to escalate their privileges to cluster-administrator level, gain access to sensitive data like credentials and keys across the entire cluster, and disrupt multi-tenant isolation.

Metrics

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS Score: 8.8

Product Status

Vendor Red Hat
Product Red Hat OpenShift AI 3.3
Versions Default: affected
  • unaffected from 1786109683 to * (excl.)
Vendor Red Hat
Product Red Hat OpenShift AI (RHOAI)
Versions Default: affected
Vendor Red Hat
Product Red Hat OpenShift AI (RHOAI)
Versions Default: affected
Vendor Red Hat
Product Red Hat OpenShift AI (RHOAI)
Versions Default: affected
Vendor Red Hat
Product Red Hat OpenShift AI (RHOAI)
Versions Default: affected
Vendor Red Hat
Product Red Hat OpenShift AI (RHOAI)
Versions Default: affected
Vendor Red Hat
Product Red Hat OpenShift AI (RHOAI)
Versions Default: affected
Vendor Red Hat
Product Red Hat OpenShift AI (RHOAI)
Versions Default: affected

Workarounds

To mitigate this issue, restrict access to the opendatahub namespace to limit potential compromise of the dashboard pod. Implement egress NetworkPolicy rules to control and restrict outbound network traffic from the dashboard. Additionally, configure audit log alerting to monitor for and detect any unexpected creation of ClusterRoleBindings within the cluster.

References

Problem Types

  • Execution with Unnecessary Privileges CWE