odh-dashboard vulnerabilities

A vulnerability was found in odh-dashboard related to how RoleBindings are created. The system does not properly validate the 'roleRef' field, allowing a user to specify an arbitrary role, including highly privileged ones like 'cluster-admin'. This can lead to privilege escalation and persistent control over the system.

A vulnerability in odh-dashboard allows an attacker who has compromised the dashboard's Service Account (SA) token to exploit overly broad permissions granted to the SA. This enables privilege escalation to cluster-administrator level, access to sensitive data like credentials and keys, and disruption of multi-tenant isolation.

A flaw in the odh-dashboard web component of Red Hat OpenShift AI (RHOAI) due to incorrect network binding allows a malicious actor within the cluster to bypass authentication and impersonate any user by providing an arbitrary access token.

A vulnerability was found in the odh-dashboard component of Red Hat OpenShift AI (RHOAI) that allows disclosure of Kubernetes Service Account tokens through a NodeJS endpoint. This could enable an attacker to gain unauthorized access to Kubernetes resources.