Skip to content
OpenAdvisories
Medium · 6.5 CVE-2026-16456 EUVD-2026-55811GHSA-w7qg-jg9c-w9mm

Odh-model-controller: odh-model-controller: cross-namespace secret read via nim account crd confused deputy

Published Aug 10, 2026 · Updated Aug 11, 2026 · Assigned by redhat

Description

A flaw was found in the `odh-model-controller`. An authenticated user with permissions to create custom resources can exploit a vulnerability in the `loadSecret` function. This function improperly reads the Secret namespace from user-controlled input without validation. This allows an attacker to read sensitive API keys and cloud credentials from other namespaces, leading to information disclosure.

Affected products

VendorProductAffectedFixed
Red Hat Red Hat OpenShift AI 2.25 — —
Red Hat Red Hat OpenShift AI 3.3 — —
Red Hat Red Hat OpenShift AI 3.4 — —

Advisories 1

References