{"id":"CVE-2024-7557","state":"PUBLISHED","title":"Odh-dashboard: odh-model-controller: cross-model authentication bypass in openshift ai","description":"A vulnerability was found in OpenShift AI that allows for authentication bypass and privilege escalation across models within the same namespace. When deploying AI models, the UI provides the option to protect models with authentication. However, credentials from one model can be used to access other models and APIs within the same namespace. The exposed ServiceAccount tokens, visible in the UI, can be utilized with oc --token={token} to exploit the elevated view privileges associated with the ServiceAccount, leading to unauthorized access to additional resources.","publishedAt":"2024-08-08T21:33:14.505Z","updatedAt":"2026-10-30T16:50:57.000Z","severity":{"score":8.8,"label":"High","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","source":"redhat"},"assigner":"redhat","products":["odh-dashboard","Red Hat RHOAI-2.14-RHEL-8","Red Hat Red Hat OpenShift Data Science (RHODS)"],"affected":[{"packageName":"odh-dashboard","defaultStatus":"unknown","versions":[{"version":"2.8.*","status":"affected","versionType":"semver"},{"version":"2.11","status":"affected","versionType":"semver"},{"version":"a122ad06a297f4e8b2a065eece910aa882cc3fa6","status":"unaffected","versionType":"git"}],"collectionURL":"https://github.com/opendatahub-io/odh-dashboard"},{"vendor":"Red Hat","product":"RHOAI-2.14-RHEL-8","packageName":"rhoai/odh-codeflare-operator-rhel8","defaultStatus":"affected","versions":[{"version":"v2.14.0-11","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_ai:2.14::el8"]},{"vendor":"Red Hat","product":"RHOAI-2.14-RHEL-8","packageName":"rhoai/odh-dashboard-rhel8","defaultStatus":"affected","versions":[{"version":"v2.14.0-11","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_ai:2.14::el8"]},{"vendor":"Red Hat","product":"RHOAI-2.14-RHEL-8","packageName":"rhoai/odh-data-science-pipelines-argo-argoexec-rhel8","defaultStatus":"affected","versions":[{"version":"v2.14.0-5","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_ai:2.14::el8"]},{"vendor":"Red Hat","product":"RHOAI-2.14-RHEL-8","packageName":"rhoai/odh-data-science-pipelines-argo-workflowcontroller-rhel8","defaultStatus":"affected","versions":[{"version":"v2.14.0-5","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_ai:2.14::el8"]},{"vendor":"Red Hat","product":"RHOAI-2.14-RHEL-8","packageName":"rhoai/odh-data-science-pipelines-operator-controller-rhel8","defaultStatus":"affected","versions":[{"version":"v2.14.0-6","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_ai:2.14::el8"]},{"vendor":"Red Hat","product":"RHOAI-2.14-RHEL-8","packageName":"rhoai/odh-kf-notebook-controller-rhel8","defaultStatus":"affected","versions":[{"version":"v2.14.0-7","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_ai:2.14::el8"]},{"vendor":"Red Hat","product":"RHOAI-2.14-RHEL-8","packageName":"rhoai/odh-kuberay-operator-controller-rhel8","defaultStatus":"affected","versions":[{"version":"v2.14.0-5","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_ai:2.14::el8"]},{"vendor":"Red Hat","product":"RHOAI-2.14-RHEL-8","packageName":"rhoai/odh-kueue-controller-rhel8","defaultStatus":"affected","versions":[{"version":"v2.14.0-8","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_ai:2.14::el8"]},{"vendor":"Red Hat","product":"RHOAI-2.14-RHEL-8","packageName":"rhoai/odh-mlmd-grpc-server-rhel8","defaultStatus":"affected","versions":[{"version":"v2.14.0-5","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_ai:2.14::el8"]},{"vendor":"Red Hat","product":"RHOAI-2.14-RHEL-8","packageName":"rhoai/odh-ml-pipelines-api-server-rhel8","defaultStatus":"affected","versions":[{"version":"v2.14.0-5","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_ai:2.14::el8"]},{"vendor":"Red Hat","product":"RHOAI-2.14-RHEL-8","packageName":"rhoai/odh-ml-pipelines-api-server-v2-rhel8","defaultStatus":"affected","versions":[{"version":"v2.14.0-6","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_ai:2.14::el8"]},{"vendor":"Red Hat","product":"RHOAI-2.14-RHEL-8","packageName":"rhoai/odh-ml-pipelines-artifact-manager-rhel8","defaultStatus":"affected","versions":[{"version":"v2.14.0-5","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_ai:2.14::el8"]},{"vendor":"Red Hat","product":"RHOAI-2.14-RHEL-8","packageName":"rhoai/odh-ml-pipelines-cache-rhel8","defaultStatus":"affected","versions":[{"version":"v2.14.0-5","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_ai:2.14::el8"]},{"vendor":"Red Hat","product":"RHOAI-2.14-RHEL-8","packageName":"rhoai/odh-ml-pipelines-driver-rhel8","defaultStatus":"affected","versions":[{"version":"v2.14.0-6","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_ai:2.14::el8"]},{"vendor":"Red Hat","product":"RHOAI-2.14-RHEL-8","packageName":"rhoai/odh-ml-pipelines-launcher-rhel8","defaultStatus":"affected","versions":[{"version":"v2.14.0-6","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_ai:2.14::el8"]},{"vendor":"Red Hat","product":"RHOAI-2.14-RHEL-8","packageName":"rhoai/odh-ml-pipelines-persistenceagent-rhel8","defaultStatus":"affected","versions":[{"version":"v2.14.0-5","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_ai:2.14::el8"]},{"vendor":"Red Hat","product":"RHOAI-2.14-RHEL-8","packageName":"rhoai/odh-ml-pipelines-persistenceagent-v2-rhel8","defaultStatus":"affected","versions":[{"version":"v2.14.0-6","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_ai:2.14::el8"]},{"vendor":"Red Hat","product":"RHOAI-2.14-RHEL-8","packageName":"rhoai/odh-ml-pipelines-scheduledworkflow-rhel8","defaultStatus":"affected","versions":[{"version":"v2.14.0-5","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_ai:2.14::el8"]},{"vendor":"Red Hat","product":"RHOAI-2.14-RHEL-8","packageName":"rhoai/odh-ml-pipelines-scheduledworkflow-v2-rhel8","defaultStatus":"affected","versions":[{"version":"v2.14.0-6","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_ai:2.14::el8"]},{"vendor":"Red Hat","product":"RHOAI-2.14-RHEL-8","packageName":"rhoai/odh-mm-rest-proxy-rhel8","defaultStatus":"affected","versions":[{"version":"v2.14.0-5","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_ai:2.14::el8"]},{"vendor":"Red Hat","product":"RHOAI-2.14-RHEL-8","packageName":"rhoai/odh-model-controller-rhel8","defaultStatus":"affected","versions":[{"version":"v2.14.0-10","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_ai:2.14::el8"]},{"vendor":"Red Hat","product":"RHOAI-2.14-RHEL-8","packageName":"rhoai/odh-modelmesh-rhel8","defaultStatus":"affected","versions":[{"version":"v2.14.0-40","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_ai:2.14::el8"]},{"vendor":"Red Hat","product":"RHOAI-2.14-RHEL-8","packageName":"rhoai/odh-modelmesh-runtime-adapter-rhel8","defaultStatus":"affected","versions":[{"version":"v2.14.0-6","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_ai:2.14::el8"]},{"vendor":"Red Hat","product":"RHOAI-2.14-RHEL-8","packageName":"rhoai/odh-modelmesh-serving-controller-rhel8","defaultStatus":"affected","versions":[{"version":"v2.14.0-7","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_ai:2.14::el8"]},{"vendor":"Red Hat","product":"RHOAI-2.14-RHEL-8","packageName":"rhoai/odh-model-registry-operator-rhel8","defaultStatus":"affected","versions":[{"version":"v2.14.0-6","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_ai:2.14::el8"]},{"vendor":"Red Hat","product":"RHOAI-2.14-RHEL-8","packageName":"rhoai/odh-model-registry-rhel8","defaultStatus":"affected","versions":[{"version":"v2.14.0-6","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_ai:2.14::el8"]},{"vendor":"Red Hat","product":"RHOAI-2.14-RHEL-8","packageName":"rhoai/odh-notebook-controller-rhel8","defaultStatus":"affected","versions":[{"version":"v2.14.0-9","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_ai:2.14::el8"]},{"vendor":"Red Hat","product":"RHOAI-2.14-RHEL-8","packageName":"rhoai/odh-operator-bundle","defaultStatus":"affected","versions":[{"version":"v2.14.0-46","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_ai:2.14::el8"]},{"vendor":"Red Hat","product":"RHOAI-2.14-RHEL-8","packageName":"rhoai/odh-rhel8-operator","defaultStatus":"affected","versions":[{"version":"v2.14.0-24","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_ai:2.14::el8"]},{"vendor":"Red Hat","product":"RHOAI-2.14-RHEL-8","packageName":"rhoai/odh-training-operator-rhel8","defaultStatus":"affected","versions":[{"version":"v2.14.0-6","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_ai:2.14::el8"]},{"vendor":"Red Hat","product":"RHOAI-2.14-RHEL-8","packageName":"rhoai/odh-trustyai-service-operator-rhel8","defaultStatus":"affected","versions":[{"version":"v2.14.0-6","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_ai:2.14::el8"]},{"vendor":"Red Hat","product":"RHOAI-2.14-RHEL-8","packageName":"rhoai/odh-trustyai-service-rhel8","defaultStatus":"affected","versions":[{"version":"v2.14.0-40","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_ai:2.14::el8"]},{"vendor":"Red Hat","product":"Red Hat OpenShift Data Science (RHODS)","packageName":"rhods/odh-dashboard-rhel8","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_data_science"]},{"vendor":"Red Hat","product":"Red Hat OpenShift Data Science (RHODS)","packageName":"rhods/odh-model-controller-rhel8","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_data_science"]}],"references":["https://access.redhat.com/errata/RHBA-2024:8240","https://access.redhat.com/security/cve/CVE-2024-7557","https://bugzilla.redhat.com/show_bug.cgi?id=2303094","https://github.com/opendatahub-io/odh-dashboard/pull/3198"],"weaknesses":["CWE-305"],"ingestedAt":"2026-10-30T16:58:06.414Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2024/7xxx/CVE-2024-7557.json","commit":"fe72493474485dbf6b41c09f1b2a7ef92a166950","baselineCommit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2024-7557","state":"PUBLISHED","datePublished":"2024-08-08T21:33:14.505Z","dateUpdated":"2026-10-30T16:50:57.000Z","assignerShortName":"redhat","assignerOrgId":"53f830b8-0a3f-465b-8143-3b8a9948e749","dateReserved":"2024-08-06T11:08:34.986Z"},"containers":{"cna":{"title":"Odh-dashboard: odh-model-controller: cross-model authentication bypass in openshift ai","descriptions":[{"lang":"en","value":"A vulnerability was found in OpenShift AI that allows for authentication bypass and privilege escalation across models within the same namespace. When deploying AI models, the UI provides the option to protect models with authentication. However, credentials from one model can be used to access other models and APIs within the same namespace. The exposed ServiceAccount tokens, visible in the UI, can be utilized with oc --token={token} to exploit the elevated view privileges associated with the ServiceAccount, leading to unauthorized access to additional resources."}],"affected":[{"packageName":"odh-dashboard","defaultStatus":"unknown","versions":[{"version":"2.8.*","status":"affected","versionType":"semver"},{"version":"2.11","status":"affected","versionType":"semver"},{"version":"a122ad06a297f4e8b2a065eece910aa882cc3fa6","status":"unaffected","versionType":"git"}],"collectionURL":"https://github.com/opendatahub-io/odh-dashboard"},{"vendor":"Red Hat","product":"RHOAI-2.14-RHEL-8","packageName":"rhoai/odh-codeflare-operator-rhel8","defaultStatus":"affected","versions":[{"version":"v2.14.0-11","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_ai:2.14::el8"]},{"vendor":"Red Hat","product":"RHOAI-2.14-RHEL-8","packageName":"rhoai/odh-dashboard-rhel8","defaultStatus":"affected","versions":[{"version":"v2.14.0-11","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_ai:2.14::el8"]},{"vendor":"Red Hat","product":"RHOAI-2.14-RHEL-8","packageName":"rhoai/odh-data-science-pipelines-argo-argoexec-rhel8","defaultStatus":"affected","versions":[{"version":"v2.14.0-5","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_ai:2.14::el8"]},{"vendor":"Red Hat","product":"RHOAI-2.14-RHEL-8","packageName":"rhoai/odh-data-science-pipelines-argo-workflowcontroller-rhel8","defaultStatus":"affected","versions":[{"version":"v2.14.0-5","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_ai:2.14::el8"]},{"vendor":"Red Hat","product":"RHOAI-2.14-RHEL-8","packageName":"rhoai/odh-data-science-pipelines-operator-controller-rhel8","defaultStatus":"affected","versions":[{"version":"v2.14.0-6","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_ai:2.14::el8"]},{"vendor":"Red Hat","product":"RHOAI-2.14-RHEL-8","packageName":"rhoai/odh-kf-notebook-controller-rhel8","defaultStatus":"affected","versions":[{"version":"v2.14.0-7","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_ai:2.14::el8"]},{"vendor":"Red Hat","product":"RHOAI-2.14-RHEL-8","packageName":"rhoai/odh-kuberay-operator-controller-rhel8","defaultStatus":"affected","versions":[{"version":"v2.14.0-5","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_ai:2.14::el8"]},{"vendor":"Red Hat","product":"RHOAI-2.14-RHEL-8","packageName":"rhoai/odh-kueue-controller-rhel8","defaultStatus":"affected","versions":[{"version":"v2.14.0-8","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_ai:2.14::el8"]},{"vendor":"Red Hat","product":"RHOAI-2.14-RHEL-8","packageName":"rhoai/odh-mlmd-grpc-server-rhel8","defaultStatus":"affected","versions":[{"version":"v2.14.0-5","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_ai:2.14::el8"]},{"vendor":"Red Hat","product":"RHOAI-2.14-RHEL-8","packageName":"rhoai/odh-ml-pipelines-api-server-rhel8","defaultStatus":"affected","versions":[{"version":"v2.14.0-5","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_ai:2.14::el8"]},{"vendor":"Red Hat","product":"RHOAI-2.14-RHEL-8","packageName":"rhoai/odh-ml-pipelines-api-server-v2-rhel8","defaultStatus":"affected","versions":[{"version":"v2.14.0-6","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_ai:2.14::el8"]},{"vendor":"Red Hat","product":"RHOAI-2.14-RHEL-8","packageName":"rhoai/odh-ml-pipelines-artifact-manager-rhel8","defaultStatus":"affected","versions":[{"version":"v2.14.0-5","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_ai:2.14::el8"]},{"vendor":"Red Hat","product":"RHOAI-2.14-RHEL-8","packageName":"rhoai/odh-ml-pipelines-cache-rhel8","defaultStatus":"affected","versions":[{"version":"v2.14.0-5","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_ai:2.14::el8"]},{"vendor":"Red Hat","product":"RHOAI-2.14-RHEL-8","packageName":"rhoai/odh-ml-pipelines-driver-rhel8","defaultStatus":"affected","versions":[{"version":"v2.14.0-6","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_ai:2.14::el8"]},{"vendor":"Red Hat","product":"RHOAI-2.14-RHEL-8","packageName":"rhoai/odh-ml-pipelines-launcher-rhel8","defaultStatus":"affected","versions":[{"version":"v2.14.0-6","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_ai:2.14::el8"]},{"vendor":"Red Hat","product":"RHOAI-2.14-RHEL-8","packageName":"rhoai/odh-ml-pipelines-persistenceagent-rhel8","defaultStatus":"affected","versions":[{"version":"v2.14.0-5","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_ai:2.14::el8"]},{"vendor":"Red Hat","product":"RHOAI-2.14-RHEL-8","packageName":"rhoai/odh-ml-pipelines-persistenceagent-v2-rhel8","defaultStatus":"affected","versions":[{"version":"v2.14.0-6","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_ai:2.14::el8"]},{"vendor":"Red Hat","product":"RHOAI-2.14-RHEL-8","packageName":"rhoai/odh-ml-pipelines-scheduledworkflow-rhel8","defaultStatus":"affected","versions":[{"version":"v2.14.0-5","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_ai:2.14::el8"]},{"vendor":"Red Hat","product":"RHOAI-2.14-RHEL-8","packageName":"rhoai/odh-ml-pipelines-scheduledworkflow-v2-rhel8","defaultStatus":"affected","versions":[{"version":"v2.14.0-6","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_ai:2.14::el8"]},{"vendor":"Red Hat","product":"RHOAI-2.14-RHEL-8","packageName":"rhoai/odh-mm-rest-proxy-rhel8","defaultStatus":"affected","versions":[{"version":"v2.14.0-5","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_ai:2.14::el8"]},{"vendor":"Red Hat","product":"RHOAI-2.14-RHEL-8","packageName":"rhoai/odh-model-controller-rhel8","defaultStatus":"affected","versions":[{"version":"v2.14.0-10","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_ai:2.14::el8"]},{"vendor":"Red Hat","product":"RHOAI-2.14-RHEL-8","packageName":"rhoai/odh-modelmesh-rhel8","defaultStatus":"affected","versions":[{"version":"v2.14.0-40","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_ai:2.14::el8"]},{"vendor":"Red Hat","product":"RHOAI-2.14-RHEL-8","packageName":"rhoai/odh-modelmesh-runtime-adapter-rhel8","defaultStatus":"affected","versions":[{"version":"v2.14.0-6","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_ai:2.14::el8"]},{"vendor":"Red Hat","product":"RHOAI-2.14-RHEL-8","packageName":"rhoai/odh-modelmesh-serving-controller-rhel8","defaultStatus":"affected","versions":[{"version":"v2.14.0-7","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_ai:2.14::el8"]},{"vendor":"Red Hat","product":"RHOAI-2.14-RHEL-8","packageName":"rhoai/odh-model-registry-operator-rhel8","defaultStatus":"affected","versions":[{"version":"v2.14.0-6","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_ai:2.14::el8"]},{"vendor":"Red Hat","product":"RHOAI-2.14-RHEL-8","packageName":"rhoai/odh-model-registry-rhel8","defaultStatus":"affected","versions":[{"version":"v2.14.0-6","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_ai:2.14::el8"]},{"vendor":"Red Hat","product":"RHOAI-2.14-RHEL-8","packageName":"rhoai/odh-notebook-controller-rhel8","defaultStatus":"affected","versions":[{"version":"v2.14.0-9","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_ai:2.14::el8"]},{"vendor":"Red Hat","product":"RHOAI-2.14-RHEL-8","packageName":"rhoai/odh-operator-bundle","defaultStatus":"affected","versions":[{"version":"v2.14.0-46","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_ai:2.14::el8"]},{"vendor":"Red Hat","product":"RHOAI-2.14-RHEL-8","packageName":"rhoai/odh-rhel8-operator","defaultStatus":"affected","versions":[{"version":"v2.14.0-24","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_ai:2.14::el8"]},{"vendor":"Red Hat","product":"RHOAI-2.14-RHEL-8","packageName":"rhoai/odh-training-operator-rhel8","defaultStatus":"affected","versions":[{"version":"v2.14.0-6","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_ai:2.14::el8"]},{"vendor":"Red Hat","product":"RHOAI-2.14-RHEL-8","packageName":"rhoai/odh-trustyai-service-operator-rhel8","defaultStatus":"affected","versions":[{"version":"v2.14.0-6","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_ai:2.14::el8"]},{"vendor":"Red Hat","product":"RHOAI-2.14-RHEL-8","packageName":"rhoai/odh-trustyai-service-rhel8","defaultStatus":"affected","versions":[{"version":"v2.14.0-40","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_ai:2.14::el8"]},{"vendor":"Red Hat","product":"Red Hat OpenShift Data Science (RHODS)","packageName":"rhods/odh-dashboard-rhel8","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_data_science"]},{"vendor":"Red Hat","product":"Red Hat OpenShift Data Science (RHODS)","packageName":"rhods/odh-model-controller-rhel8","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_data_science"]}],"references":[{"url":"https://access.redhat.com/errata/RHBA-2024:8240","name":"RHBA-2024:8240","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/security/cve/CVE-2024-7557","tags":["vdb-entry","x_refsource_REDHAT"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2303094","name":"RHBZ#2303094","tags":["issue-tracking","x_refsource_REDHAT"]},{"url":"https://github.com/opendatahub-io/odh-dashboard/pull/3198"}],"metrics":[{"other":{"content":{"value":"Important","namespace":"https://access.redhat.com/security/updates/classification/"},"type":"Red Hat severity rating"}},{"cvssV3_1":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"format":"CVSS"}],"problemTypes":[{"descriptions":[{"cweId":"CWE-305","description":"Authentication Bypass by Primary Weakness","lang":"en","type":"CWE"}]}],"providerMetadata":{"shortName":"redhat","orgId":"53f830b8-0a3f-465b-8143-3b8a9948e749","dateUpdated":"2026-10-30T16:50:57.000Z"},"datePublic":"2024-08-07T00:00:00.000Z","x_redhatCweChain":"CWE-305: Authentication Bypass by Primary Weakness","workarounds":[{"lang":"en","value":"Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability."}],"timeline":[{"lang":"en","time":"2024-08-06T10:31:41.202Z","value":"Reported to Red Hat."},{"lang":"en","time":"2024-08-07T00:00:00.000Z","value":"Made public."}],"credits":[{"lang":"en","value":"Red Hat would like to thank Adam Bellusci (RedHat) for reporting this issue."}],"x_generator":{"engine":"cvelib 1.8.0"}},"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2024-08-09T13:52:08.137088Z","id":"CVE-2024-7557","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2024-08-09T13:52:27.946Z"}}]}}}