Description
A flaw was found in the `odh-model-controller`. An authenticated user with permissions to create custom resources can exploit a vulnerability in the `loadSecret` function. This function improperly reads the Secret namespace from user-controlled input without validation. This allows an attacker to read sensitive API keys and cloud credentials from other namespaces, leading to information disclosure.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
Red Hat Red Hat OpenShift AI 2.25
Default version status: affected
1785187158 to < *unaffected
Red Hat Red Hat OpenShift AI 3.3
Default version status: affected
1785189333 to < *unaffected
Red Hat Red Hat OpenShift AI 3.4
Default version status: affected
1784950479 to < *unaffected