CVE-2026-5483

Отчет

A flaw in the odh-dashboard component of Red Hat OpenShift AI allows for the disclosure of Kubernetes Service Account tokens through a NodeJS endpoint. This vulnerability could enable an attacker to gain unauthorized access to Kubernetes resources within the OpenShift AI environment. The NIM serving API endpoint (/api/nim-serving/:nimResource) returns the full K8 client response including the dashboard's service account token. Requirements to exploit:

• Authenticated access to the dashboard
• The NIM account CR must exist on the cluster for 2.25+
• The target secret must exist and if the secret referenced by the Account CR hasn't been created yet, the endpoint returns a 404 and no token is leaked

Меры по смягчению последствий

If applying the update is not immediately possible, the vulnerability can be mitigated by disabling or removing the NIM (NVIDIA Inference Microservice) integration from the Red Hat OpenShift AI (RHOAI) environment.