CVE-2026-18950
HighCVSS 8.8Exploitation Probability (EPSS)
Low risk42th percentile - higher than 42% of all known CVEs
Summary
A vulnerability was found in odh-dashboard related to how RoleBindings are created. The system does not properly validate the 'roleRef' field, allowing a user to specify an arbitrary role, including highly privileged ones like 'cluster-admin'. This can lead to privilege escalation and persistent control over the system.
Risk Assessment
An attacker can gain unauthorized elevated access within their namespace and potentially persistent control over the system, posing a serious threat to environment integrity.
Recommendation
Update odh-dashboard to a patched version and implement validation of roleRef fields.
Other vulnerabilities in odh-dashboard
See all- CVE-2026-86332Medium
A flaw was found in odh-dashboard in Red Hat OpenShift AI. The backend-for-frontend route GET /api/nim-serving/:nimResource reads Kubernetes Secrets using the dashboard service account and returns the full Secret object, including .data, without an authorization check. Any authenticated dashboard user can retrieve the cluster NVIDIA NGC API key Secret (apiKeySecret) and the NIM image pull secret (nimPullSecret). This is missing authorization (CWE-862) and insufficiently protected credentials (CWE-522).
- CVE-2026-18949High
A vulnerability in odh-dashboard allows an attacker who has compromised the dashboard's Service Account (SA) token to exploit overly broad permissions granted to the SA. This enables privilege escalation to cluster-administrator level, access to sensitive data like credentials and keys, and disruption of multi-tenant isolation.
- CVE-2026-16745High
A flaw in the odh-dashboard web component of Red Hat OpenShift AI (RHOAI) due to incorrect network binding allows a malicious actor within the cluster to bypass authentication and impersonate any user by providing an arbitrary access token.
- CVE-2026-5483High
A vulnerability was found in the odh-dashboard component of Red Hat OpenShift AI (RHOAI) that allows disclosure of Kubernetes Service Account tokens through a NodeJS endpoint. This could enable an attacker to gain unauthorized access to Kubernetes resources.
Original NVD description (English source)
A flaw was found in odh-dashboard. An authenticated user of the dashboard can exploit a vulnerability related to how RoleBindings are created. The system does not properly validate the `roleRef` field, allowing a user to specify an arbitrary role, including highly privileged ones like `cluster-admin`. This can lead to privilege escalation, where an attacker gains unauthorized elevated access within their namespace and potentially persistent control over the system.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS