Log in Start free

Vulnerability · Published Sep 7, 2026 · Assigned by redhat

CVE-2026-86332Odh-dashboard: odh-dashboard: nim credential secret readable by any authenticated user

Medium 6.5

In plain English

A medium-severity missing authorization in Red Hat OpenShift AI 2.25 from Red Hat. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 36% of all known vulnerabilities).

Severity (CVSS 3.1)6.5Medium
Exploit odds (30 days)0.4%top 64.0% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

A flaw was found in odh-dashboard in Red Hat OpenShift AI. The backend-for-frontend route GET /api/nim-serving/:nimResource reads Kubernetes Secrets using the dashboard service account and returns the full Secret object, including .data, without an authorization check. Any authenticated dashboard user can retrieve the cluster NVIDIA NGC API key Secret (apiKeySecret) and the NIM image pull secret (nimPullSecret). Create and delete of the same NIM credential are admin-gated; the read path is not. This is missing authorization (CWE-862) and insufficiently protected credentials (CWE-522). It is distinct from CVE-2026-5483 (service-account token leak in the Kubernetes client response wrapper on the same route) and CVE-2026-16456 (odh-model-controller cross-namespace confused deputy).

Affected products (as reported)

VendorProductVersions
Red Hat Red Hat OpenShift AI 2.25 see references
Red Hat Red Hat OpenShift AI 3.5 see references
Red Hat Red Hat OpenShift AI (RHOAI) see references
Red Hat Red Hat OpenShift AI (RHOAI) see references
Red Hat Red Hat OpenShift AI (RHOAI) see references
Red Hat Red Hat OpenShift AI (RHOAI) see references
Red Hat Red Hat OpenShift AI (RHOAI) see references
Red Hat Red Hat OpenShift AI (RHOAI) see references
Red Hat Red Hat OpenShift AI (RHOAI) see references
Red Hat Red Hat OpenShift AI (RHOAI) see references
Red Hat Red Hat OpenShift AI (RHOAI) see references
Red Hat Red Hat OpenShift AI (RHOAI) see references
Red Hat Red Hat OpenShift AI (RHOAI) see references

Weakness: CWE-862 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

References