A flaw was found in odh-dashboard. This vulnerability allows an attacker, who has compromised the dashboard's Service Account (SA) token, to exploit overly broad permissions granted to the SA. This enables the attacker to escalate their privileges to cluster-administrator level, gain access to sensitive data like credentials and keys across the entire cluster, and disrupt multi-tenant isolation.
To mitigate this issue, restrict access to the opendatahub namespace to limit potential compromise of the dashboard pod. Implement egress NetworkPolicy rules to control and restrict outbound network traffic from the dashboard. Additionally, configure audit log alerting to monitor for and detect any unexpected creation of ClusterRoleBindings within the cluster.