CVE-2026-18950
HighCVSS 8.8Exploitation Probability (EPSS)
Low risk29th percentile - higher than 29% of all known CVEs
Summary
A vulnerability was found in odh-dashboard related to how RoleBindings are created. The system does not properly validate the 'roleRef' field, allowing a user to specify an arbitrary role, including highly privileged ones like 'cluster-admin'. This can lead to privilege escalation and persistent control over the system.
Risk Assessment
An attacker can gain unauthorized elevated access within their namespace and potentially persistent control over the system, posing a serious threat to environment integrity.
Recommendation
Update odh-dashboard to a patched version and implement validation of roleRef fields.
Original NVD description (English source)
A flaw was found in odh-dashboard. An authenticated user of the dashboard can exploit a vulnerability related to how RoleBindings are created. The system does not properly validate the `roleRef` field, allowing a user to specify an arbitrary role, including highly privileged ones like `cluster-admin`. This can lead to privilege escalation, where an attacker gains unauthorized elevated access within their namespace and potentially persistent control over the system.