Skip to content
CVE PROGRAM SOURCE RECORD8.8 High

CVE-2026-16745

Odh-dashboard: odh-dashboard: backend port 8080 trusts x-forwarded-access-token without origin validation

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
redhat

Description

A flaw was found in odh-dashboard, the web console component of Red Hat OpenShift AI (RHOAI). Due to incorrect network binding, a malicious actor within the cluster can bypass authentication and impersonate any user by providing an arbitrary access token. This allows an attacker to gain unauthorized access to the Kubernetes API, potentially leading to arbitrary code execution, privilege escalation, or information disclosure.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Red Hat Red Hat OpenShift AI 2.25

Default version status: affected

  • 1785940823 to < *unaffected

Red Hat Red Hat OpenShift AI 2.25

Default version status: affected

  • 1788312226 to < *unaffected

Red Hat Red Hat OpenShift AI 3.3

Default version status: affected

  • 1786109683 to < *unaffected

Red Hat Red Hat OpenShift AI 3.3

Default version status: affected

  • 1790128681 to < *unaffected

Red Hat Red Hat OpenShift AI 3.4

Default version status: affected

  • 1786109665 to < *unaffected

Red Hat Red Hat OpenShift AI 3.4

Default version status: affected

  • 1787347991 to < *unaffected

References