Skip to content
CVE PROGRAM SOURCE RECORD8.8 High

CVE-2026-18949

Odh-dashboard: odh-dashboard: clusterrole grants cluster-wide crud on secrets and rbac management resources

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
redhat

Description

A flaw was found in odh-dashboard. This vulnerability allows an attacker, who has compromised the dashboard's Service Account (SA) token, to exploit overly broad permissions granted to the SA. This enables the attacker to escalate their privileges to cluster-administrator level, gain access to sensitive data like credentials and keys across the entire cluster, and disrupt multi-tenant isolation.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Red Hat Red Hat OpenShift AI 2.25

Default version status: affected

  • 1785940823 to < *unaffected

Red Hat Red Hat OpenShift AI 2.25

Default version status: affected

  • 1791853432 to < *unaffected

Red Hat Red Hat OpenShift AI 3.3

Default version status: affected

  • 1786109683 to < *unaffected

Red Hat Red Hat OpenShift AI 3.4

Default version status: affected

  • 1786109665 to < *unaffected

Red Hat Red Hat OpenShift AI 3.4

Default version status: affected

  • 1791861032 to < *unaffected

Red Hat Red Hat OpenShift AI 3.4

Default version status: affected

  • 1791860994 to < *unaffected

Red Hat Red Hat OpenShift AI 3.4

Default version status: affected

  • 1791861214 to < *unaffected

Red Hat Red Hat OpenShift AI 3.4

Default version status: affected

  • 1791861479 to < *unaffected

Red Hat Red Hat OpenShift AI 3.4

Default version status: affected

  • 1791860708 to < *unaffected

Red Hat Red Hat OpenShift AI 3.4

Default version status: affected

  • 1791861383 to < *unaffected

Red Hat Red Hat OpenShift AI 3.4

Default version status: affected

  • 1791860918 to < *unaffected

References