Log in Start free

Vulnerability · Published Aug 10, 2026 · Assigned by redhat

CVE-2026-18949Odh-dashboard: odh-dashboard: clusterrole grants cluster-wide crud on secrets and rbac management resources

High 8.8

In plain English

A high-severity security flaw in Red Hat OpenShift AI 2.25 from Red Hat. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.7% (higher than 52% of all known vulnerabilities).

Severity (CVSS 3.1)8.8High
Exploit odds (30 days)0.7%top 48.1% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

A flaw was found in odh-dashboard. This vulnerability allows an attacker, who has compromised the dashboard's Service Account (SA) token, to exploit overly broad permissions granted to the SA. This enables the attacker to escalate their privileges to cluster-administrator level, gain access to sensitive data like credentials and keys across the entire cluster, and disrupt multi-tenant isolation.

Affected products (as reported)

VendorProductVersions
Red Hat Red Hat OpenShift AI 2.25 see references
Red Hat Red Hat OpenShift AI 2.25 see references
Red Hat Red Hat OpenShift AI 3.3 see references
Red Hat Red Hat OpenShift AI 3.4 see references
Red Hat Red Hat OpenShift AI 3.4 see references
Red Hat Red Hat OpenShift AI 3.4 see references
Red Hat Red Hat OpenShift AI 3.4 see references
Red Hat Red Hat OpenShift AI 3.4 see references
Red Hat Red Hat OpenShift AI 3.4 see references
Red Hat Red Hat OpenShift AI 3.4 see references
Red Hat Red Hat OpenShift AI 3.4 see references

Weakness: CWE-250 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

References