CVE-2026-5483
HighCVSS 8.5Exploitation Probability (EPSS)
Low risk39th percentile - higher than 39% of all known CVEs
Summary
A vulnerability was found in the odh-dashboard component of Red Hat OpenShift AI (RHOAI) that allows disclosure of Kubernetes Service Account tokens through a NodeJS endpoint. This could enable an attacker to gain unauthorized access to Kubernetes resources.
Risk Assessment
The risk involves potential unauthorized access to Kubernetes resources, which could compromise the confidentiality, integrity, and availability of data and applications within the cluster.
Recommendation
Apply the security update provided by Red Hat for the odh-dashboard component in the OpenShift AI environment immediately.
Other vulnerabilities in odh-dashboard
See all- CVE-2026-18950High
A vulnerability was found in odh-dashboard related to how RoleBindings are created. The system does not properly validate the 'roleRef' field, allowing a user to specify an arbitrary role, including highly privileged ones like 'cluster-admin'. This can lead to privilege escalation and persistent control over the system.
- CVE-2026-18949High
A vulnerability in odh-dashboard allows an attacker who has compromised the dashboard's Service Account (SA) token to exploit overly broad permissions granted to the SA. This enables privilege escalation to cluster-administrator level, access to sensitive data like credentials and keys, and disruption of multi-tenant isolation.
- CVE-2026-16745High
A flaw in the odh-dashboard web component of Red Hat OpenShift AI (RHOAI) due to incorrect network binding allows a malicious actor within the cluster to bypass authentication and impersonate any user by providing an arbitrary access token.
Original NVD description (English source)
A flaw was found in odh-dashboard in Red Hat Openshift AI. This vulnerability in the `odh-dashboard` component of Red Hat OpenShift AI (RHOAI) allows for the disclosure of Kubernetes Service Account tokens through a NodeJS endpoint. This could enable an attacker to gain unauthorized access to Kubernetes resources.