Skip to content
fr Sign in
6.5 Medium

CVE-2026-86332 A flaw was found in odh-dashboard in Red Hat OpenShift AI

Description

A flaw was found in odh-dashboard in Red Hat OpenShift AI. The backend-for-frontend route GET /api/nim-serving/:nimResource reads Kubernetes Secrets using the dashboard service account and returns the full Secret object, including .data, without an authorization check. Any authenticated dashboard user can retrieve the cluster NVIDIA NGC API key Secret (apiKeySecret) and the NIM image pull secret (nimPullSecret). Create and delete of the same NIM credential are admin-gated; the read path is not. This is missing authorization (CWE-862) and insufficiently protected credentials (CWE-522). It is distinct from CVE-2026-5483 (service-account token leak in the Kubernetes client response wrapper on the same route) and CVE-2026-16456 (odh-model-controller cross-namespace confused deputy).

Affected products and versions

Product Affected versions Fixed in
Red Hat OpenShift AI (RHOAI) Versions not published
Red Hat OpenShift AI 3.5 1791945160 earliest → < 1791945160 1791945160
Red Hat OpenShift AI 2.25 1791853525 earliest → < 1791853525 1791853525

References

Timeline

  1. Published
  2. Last modified

Other CVEs of Red Hat OpenShift AI (RHOAI)

The 388 CVEs of Red Hat OpenShift AI (RHOAI) →
CVE-2026-83494 Training-operator: pytorchjob validateupdate casts oldjob from newobj, bypassing managedby immutability (asvs v5.1.3; upstream bug) Not rated CVE-2026-83493 Distributed-workloads: github actions pinned by mutable tag/branch, including third-party snyk/actions/setup@master Not rated CVE-2026-107912 Io.quarkus/quarkus-vertx-http: quarkus-vertx-http: authorization bypass in management interface via path concatenation flaw 7.7 High CVE-2026-120194 Json-glib: json-glib: infinite loop in json_path_query() with negative jsonpath slice step 7.5 High
Track this CVE