Описание
A flaw was found in odh-dashboard. This vulnerability allows an attacker, who has compromised the dashboard's Service Account (SA) token, to exploit overly broad permissions granted to the SA. This enables the attacker to escalate their privileges to cluster-administrator level, gain access to sensitive data like credentials and keys across the entire cluster, and disrupt multi-tenant isolation.
Отчет
This is a Critical vulnerability in Red Hat OpenShift AI where the odh-dashboard ClusterRole grants its Service Account excessive cluster-wide permissions. A compromised dashboard Service Account could read and delete sensitive secrets across the cluster and create ClusterRoleBindings, leading to full cluster-admin privilege escalation and breaking multi-tenant isolation. This risk is present in Red Hat OpenShift AI deployments with the dashboard component enabled.
Меры по смягчению последствий
To mitigate this issue, restrict access to the opendatahub namespace to limit potential compromise of the dashboard pod. Implement egress NetworkPolicy rules to control and restrict outbound network traffic from the dashboard. Additionally, configure audit log alerting to monitor for and detect any unexpected creation of ClusterRoleBindings within the cluster.
Затронутые пакеты
| Платформа | Пакет | Состояние | Рекомендация | Релиз |
|---|---|---|---|---|
| Red Hat OpenShift AI (RHOAI) | rhoai/odh-mod-arch-automl-rhel9 | Affected | ||
| Red Hat OpenShift AI (RHOAI) | rhoai/odh-mod-arch-autorag-rhel9 | Affected | ||
| Red Hat OpenShift AI (RHOAI) | rhoai/odh-mod-arch-eval-hub-rhel9 | Affected | ||
| Red Hat OpenShift AI (RHOAI) | rhoai/odh-mod-arch-gen-ai-rhel9 | Affected | ||
| Red Hat OpenShift AI (RHOAI) | rhoai/odh-mod-arch-maas-rhel9 | Affected | ||
| Red Hat OpenShift AI (RHOAI) | rhoai/odh-mod-arch-mlflow-rhel9 | Affected | ||
| Red Hat OpenShift AI (RHOAI) | rhoai/odh-mod-arch-model-registry-rhel9 | Affected | ||
| Red Hat OpenShift AI 2.25 | rhoai/odh-dashboard-rhel9 | Fixed | RHSA-2026:53261 | 11.08.2026 |
| Red Hat OpenShift AI 3.3 | rhoai/odh-dashboard-rhel9 | Fixed | RHSA-2026:53263 | 11.08.2026 |
| Red Hat OpenShift AI 3.4 | rhoai/odh-dashboard-rhel9 | Fixed | RHSA-2026:53262 | 11.08.2026 |
Показывать по
Дополнительная информация
Статус:
EPSS
8.8 High
CVSS3
Связанные уязвимости
A flaw was found in odh-dashboard. This vulnerability allows an attacker, who has compromised the dashboard's Service Account (SA) token, to exploit overly broad permissions granted to the SA. This enables the attacker to escalate their privileges to cluster-administrator level, gain access to sensitive data like credentials and keys across the entire cluster, and disrupt multi-tenant isolation.
A flaw was found in odh-dashboard. This vulnerability allows an attacker, who has compromised the dashboard's Service Account (SA) token, to exploit overly broad permissions granted to the SA. This enables the attacker to escalate their privileges to cluster-administrator level, gain access to sensitive data like credentials and keys across the entire cluster, and disrupt multi-tenant isolation.
EPSS
8.8 High
CVSS3