Vulnerability · Published Aug 10, 2026 · Assigned by redhat

CVE-2026-14450Maas-billing: maas api: privilege escalation via forged http headers due to missing authentication

Critical 9.9

In plain English

A critical-severity authentication bypass by spoofing in Red Hat OpenShift AI 3.4 from Red Hat. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.7% (higher than 53% of all known vulnerabilities).

Severity (CVSS 3.1)9.9Critical

Exploit odds (30 days)0.7%top 47.0% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

A flaw was found in the MaaS API. This vulnerability allows any pod within the cluster to bypass the Kuadrant AuthPolicy gateway by forging HTTP headers, specifically `X-MaaS-Username` and `X-MaaS-Group`, which are trusted verbatim. This lack of first-party authentication enables an attacker to gain unauthorized access and escalate privileges. The concrete consequences include the ability to mint Kubernetes ServiceAccount tokens in other tenants' namespaces, revoke API keys, and exfiltrate sensitive model access configuration.

Affected products (as reported)

Vendor	Product	Versions
Red Hat	Red Hat OpenShift AI 3.4	see references
Red Hat	Red Hat OpenShift AI 3.4	see references
Red Hat	Red Hat OpenShift AI (RHOAI)	see references
Red Hat	Red Hat OpenShift AI (RHOAI)	see references

Weakness: CWE-290 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

References

RHSA-2026:53262 vendor-advisory, x_refsource_REDHAT
RHSA-2026:60520 vendor-advisory, x_refsource_REDHAT
https://access.redhat.com/security/cve/CVE-2026-14450 vdb-entry, x_refsource_REDHAT
RHBZ#2496373 issue-tracking, x_refsource_REDHAT