CVE-2026-18949
HighCVSS 8.8Exploitation Probability (EPSS)
Low risk35th percentile - higher than 35% of all known CVEs
Summary
A vulnerability in odh-dashboard allows an attacker who has compromised the dashboard's Service Account (SA) token to exploit overly broad permissions granted to the SA. This enables privilege escalation to cluster-administrator level, access to sensitive data like credentials and keys, and disruption of multi-tenant isolation.
Risk Assessment
An attacker can gain full control over the cluster, steal sensitive data, and break tenant isolation, posing a critical security threat.
Recommendation
Update odh-dashboard to a patched version and restrict the service account permissions to the minimum required.
Original NVD description (English source)
A flaw was found in odh-dashboard. This vulnerability allows an attacker, who has compromised the dashboard's Service Account (SA) token, to exploit overly broad permissions granted to the SA. This enables the attacker to escalate their privileges to cluster-administrator level, gain access to sensitive data like credentials and keys across the entire cluster, and disrupt multi-tenant isolation.