Description
A flaw was found in odh-dashboard in Red Hat Openshift AI. This vulnerability in the `odh-dashboard` component of Red Hat OpenShift AI (RHOAI) allows for the disclosure of Kubernetes Service Account tokens through a NodeJS endpoint. This could enable an attacker to gain unauthorized access to Kubernetes resources.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Red Hat | Red Hat OpenShift AI 2.16 | — | — |
| Red Hat | Red Hat OpenShift AI 2.25 | — | — |
| Red Hat | Red Hat OpenShift AI 3.2 | — | — |
| Red Hat | Red Hat OpenShift AI 3.3 | — | — |
| Red Hat | Red Hat OpenShift AI (RHOAI) | — | — |
Advisories 1
- WID-SEC-2026-1056 Red Hat OpenShift AI: Schwachstelle ermöglicht Offenlegung von Informationen und Privilegieneskalation BSI CERT-Bund (WID) · Apr 12, 2026
References
- RHSA-2026:7397 vendor-advisory
- RHSA-2026:7398 vendor-advisory
- RHSA-2026:7403 vendor-advisory
- RHSA-2026:7404 vendor-advisory
- https://access.redhat.com/security/cve/CVE-2026-5483 vdb-entry
- RHBZ#2454764 issue-tracking