{"id":"CVE-2026-5483","state":"PUBLISHED","title":"Odh-dashboard: odh dashboard kubernetes service account exposure","description":"A flaw was found in odh-dashboard in Red Hat Openshift AI. This vulnerability in the `odh-dashboard` component of Red Hat OpenShift AI (RHOAI) allows for the disclosure of Kubernetes Service Account tokens through a NodeJS endpoint. This could enable an attacker to gain unauthorized access to Kubernetes resources.","publishedAt":"2026-04-10T17:33:25.055Z","updatedAt":"2026-07-15T00:43:11.545Z","severity":{"score":8.5,"label":"High","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H","source":"redhat"},"assigner":"redhat","products":["Red Hat Red Hat OpenShift AI 2.16","Red Hat Red Hat OpenShift AI 2.25","Red Hat Red Hat OpenShift AI 3.2","Red Hat Red Hat OpenShift AI 3.3","Red Hat Red Hat OpenShift AI (RHOAI)"],"affected":[{"vendor":"Red Hat","product":"Red Hat OpenShift AI 2.16","packageName":"rhoai/odh-dashboard-rhel8","defaultStatus":"affected","versions":[{"version":"1775230902","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_ai:2.16::el8"]},{"vendor":"Red Hat","product":"Red Hat OpenShift AI 2.25","packageName":"rhoai/odh-dashboard-rhel9","defaultStatus":"affected","versions":[{"version":"1775234711","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_ai:2.25::el9"]},{"vendor":"Red Hat","product":"Red Hat OpenShift AI 3.2","packageName":"rhoai/odh-dashboard-rhel9","defaultStatus":"affected","versions":[{"version":"1775523049","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_ai:3.2::el9"]},{"vendor":"Red Hat","product":"Red Hat OpenShift AI 3.3","packageName":"rhoai/odh-dashboard-rhel9","defaultStatus":"affected","versions":[{"version":"1775239958","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_ai:3.3::el9"]},{"vendor":"Red Hat","product":"Red Hat OpenShift AI (RHOAI)","packageName":"rhoai/odh-mod-arch-gen-ai-rhel9","defaultStatus":"unaffected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"]},{"vendor":"Red Hat","product":"Red Hat OpenShift AI (RHOAI)","packageName":"rhoai/odh-mod-arch-maas-rhel9","defaultStatus":"unaffected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"]},{"vendor":"Red Hat","product":"Red Hat OpenShift AI (RHOAI)","packageName":"rhoai/odh-mod-arch-model-registry-rhel9","defaultStatus":"unaffected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"]}],"references":["https://access.redhat.com/errata/RHSA-2026:7397","https://access.redhat.com/errata/RHSA-2026:7398","https://access.redhat.com/errata/RHSA-2026:7403","https://access.redhat.com/errata/RHSA-2026:7404","https://access.redhat.com/security/cve/CVE-2026-5483","https://bugzilla.redhat.com/show_bug.cgi?id=2454764","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-5483.json"],"weaknesses":["CWE-201"],"ingestedAt":"2026-10-29T20:12:32.778Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2026/5xxx/CVE-2026-5483.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2026-5483","state":"PUBLISHED","datePublished":"2026-04-10T17:33:25.055Z","dateUpdated":"2026-07-15T00:43:11.545Z","assignerShortName":"redhat","assignerOrgId":"53f830b8-0a3f-465b-8143-3b8a9948e749","dateReserved":"2026-04-03T12:27:18.589Z"},"containers":{"cna":{"title":"Odh-dashboard: odh dashboard kubernetes service account exposure","descriptions":[{"lang":"en","value":"A flaw was found in odh-dashboard in Red Hat Openshift AI. This vulnerability in the `odh-dashboard` component of Red Hat OpenShift AI (RHOAI) allows for the disclosure of Kubernetes Service Account tokens through a NodeJS endpoint. This could enable an attacker to gain unauthorized access to Kubernetes resources."}],"affected":[{"vendor":"Red Hat","product":"Red Hat OpenShift AI 2.16","packageName":"rhoai/odh-dashboard-rhel8","defaultStatus":"affected","versions":[{"version":"1775230902","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_ai:2.16::el8"]},{"vendor":"Red Hat","product":"Red Hat OpenShift AI 2.25","packageName":"rhoai/odh-dashboard-rhel9","defaultStatus":"affected","versions":[{"version":"1775234711","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_ai:2.25::el9"]},{"vendor":"Red Hat","product":"Red Hat OpenShift AI 3.2","packageName":"rhoai/odh-dashboard-rhel9","defaultStatus":"affected","versions":[{"version":"1775523049","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_ai:3.2::el9"]},{"vendor":"Red Hat","product":"Red Hat OpenShift AI 3.3","packageName":"rhoai/odh-dashboard-rhel9","defaultStatus":"affected","versions":[{"version":"1775239958","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_ai:3.3::el9"]},{"vendor":"Red Hat","product":"Red Hat OpenShift AI (RHOAI)","packageName":"rhoai/odh-mod-arch-gen-ai-rhel9","defaultStatus":"unaffected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"]},{"vendor":"Red Hat","product":"Red Hat OpenShift AI (RHOAI)","packageName":"rhoai/odh-mod-arch-maas-rhel9","defaultStatus":"unaffected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"]},{"vendor":"Red Hat","product":"Red Hat OpenShift AI (RHOAI)","packageName":"rhoai/odh-mod-arch-model-registry-rhel9","defaultStatus":"unaffected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"]}],"references":[{"url":"https://access.redhat.com/errata/RHSA-2026:7397","name":"RHSA-2026:7397","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2026:7398","name":"RHSA-2026:7398","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2026:7403","name":"RHSA-2026:7403","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2026:7404","name":"RHSA-2026:7404","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-5483","tags":["vdb-entry","x_refsource_REDHAT"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2454764","name":"RHBZ#2454764","tags":["issue-tracking","x_refsource_REDHAT"]}],"metrics":[{"other":{"content":{"value":"Important","namespace":"https://access.redhat.com/security/updates/classification/"},"type":"Red Hat severity rating"}},{"cvssV3_1":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.5,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"CHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H","version":"3.1"},"format":"CVSS"}],"problemTypes":[{"descriptions":[{"cweId":"CWE-201","description":"Insertion of Sensitive Information Into Sent Data","lang":"en","type":"CWE"}]}],"providerMetadata":{"shortName":"redhat","orgId":"53f830b8-0a3f-465b-8143-3b8a9948e749","dateUpdated":"2026-04-29T05:20:59.210Z"},"datePublic":"2026-04-10T17:16:00.000Z","x_redhatCweChain":"CWE-201: Insertion of Sensitive Information Into Sent Data","workarounds":[{"lang":"en","value":"If applying the update is not immediately possible, the vulnerability can be mitigated by disabling or removing the NIM (NVIDIA Inference Microservice) integration from the Red Hat OpenShift AI (RHOAI) environment."}],"timeline":[{"lang":"en","time":"2026-04-03T00:00:00.000Z","value":"Reported to Red Hat."},{"lang":"en","time":"2026-04-10T17:16:00.000Z","value":"Made public."}],"x_generator":{"engine":"cvelib 1.8.0"}},"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2026-04-10T18:33:58.848733Z","id":"CVE-2026-5483","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2026-04-10T18:34:06.822Z"}},{"title":"odh-dashboard: ODH Dashboard Kubernetes Service Account Exposure","descriptions":[{"lang":"en","value":"A flaw was found in odh-dashboard in Red Hat Openshift AI. This vulnerability in the `odh-dashboard` component of Red Hat OpenShift AI (RHOAI) allows for the disclosure of Kubernetes Service Account tokens through a NodeJS endpoint. This could enable an attacker to gain unauthorized access to Kubernetes resources."}],"affected":[{"vendor":"Red Hat","product":"Red Hat OpenShift AI 2.16","packageName":"rhoai/odh-dashboard-rhel8","defaultStatus":"affected","versions":[{"version":"1775230902","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_ai:2.16::el8"]},{"vendor":"Red Hat","product":"Red Hat OpenShift AI 2.25","packageName":"rhoai/odh-dashboard-rhel9","defaultStatus":"affected","versions":[{"version":"1775234711","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_ai:2.25::el9"]},{"vendor":"Red Hat","product":"Red Hat OpenShift AI 3.2","packageName":"rhoai/odh-dashboard-rhel9","defaultStatus":"affected","versions":[{"version":"1775523049","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_ai:3.2::el9"]},{"vendor":"Red Hat","product":"Red Hat OpenShift AI 3.3","packageName":"rhoai/odh-dashboard-rhel9","defaultStatus":"affected","versions":[{"version":"1775239958","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_ai:3.3::el9"]},{"vendor":"Red Hat","product":"Red Hat OpenShift AI (RHOAI)","packageName":"rhoai/odh-mod-arch-gen-ai-rhel9","defaultStatus":"unaffected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"]},{"vendor":"Red Hat","product":"Red Hat OpenShift AI (RHOAI)","packageName":"rhoai/odh-mod-arch-maas-rhel9","defaultStatus":"unaffected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"]},{"vendor":"Red Hat","product":"Red Hat OpenShift AI (RHOAI)","packageName":"rhoai/odh-mod-arch-model-registry-rhel9","defaultStatus":"unaffected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"]}],"references":[{"url":"https://access.redhat.com/security/cve/CVE-2026-5483","tags":["vdb-entry","x_refsource_REDHAT"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2454764","name":"RHBZ#2454764","tags":["issue-tracking","x_refsource_REDHAT"]},{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-5483.json","tags":["x_sadp-csaf-vex"]},{"url":"https://access.redhat.com/errata/RHSA-2026:7397","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2026:7398","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2026:7404","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2026:7403","tags":["vendor-advisory","x_refsource_REDHAT"]}],"metrics":[{"other":{"content":{"namespace":"https://access.redhat.com/security/updates/classification/","value":"Important"},"type":"Red Hat severity rating"}},{"cvssV3_1":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.5,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"CHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H","version":"3.1"},"format":"CVSS"}],"problemTypes":[{"descriptions":[{"cweId":"CWE-201","description":"Insertion of Sensitive Information Into Sent Data","lang":"en","type":"CWE"}]}],"providerMetadata":{"shortName":"redhat-SADP","orgId":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","dateUpdated":"2026-07-15T00:43:11.545Z"},"datePublic":"2026-04-10T17:16:00.000Z","solutions":[{"lang":"en","value":"RHSA-2026:7397: Red Hat OpenShift AI 2.16"},{"lang":"en","value":"RHSA-2026:7398: Red Hat OpenShift AI 2.25"},{"lang":"en","value":"RHSA-2026:7404: Red Hat OpenShift AI 3.2"},{"lang":"en","value":"RHSA-2026:7403: Red Hat OpenShift AI 3.3"}],"timeline":[{"lang":"en","time":"2026-04-03T00:00:00.000Z","value":"Reported to Red Hat."},{"lang":"en","time":"2026-04-10T17:16:00.000Z","value":"Made public."}],"workarounds":[{"lang":"en","value":"If applying the update is not immediately possible, the vulnerability can be mitigated by disabling or removing the NIM (NVIDIA Inference Microservice) integration from the Red Hat OpenShift AI (RHOAI) environment."}],"x_adpType":"supplier","x_generator":{"engine":"sadp-cli 1.0.0"}}]}}}