Skip to content
OpenAdvisories
High · 8.8 CVE-2026-18949 EUVD-2026-55819GHSA-vccp-8mm3-h2f6

Odh-dashboard: odh-dashboard: clusterrole grants cluster-wide crud on secrets and rbac management resources

Published Aug 10, 2026 · Updated Oct 22, 2026 · Assigned by redhat

Description

A flaw was found in odh-dashboard. This vulnerability allows an attacker, who has compromised the dashboard's Service Account (SA) token, to exploit overly broad permissions granted to the SA. This enables the attacker to escalate their privileges to cluster-administrator level, gain access to sensitive data like credentials and keys across the entire cluster, and disrupt multi-tenant isolation.

Affected products

VendorProductAffectedFixed
Red Hat Red Hat OpenShift AI 2.25 — —
Red Hat Red Hat OpenShift AI 3.3 — —
Red Hat Red Hat OpenShift AI 3.4 — —

Advisories 1

References