CVE-2026-16745: Odh-dashboard: odh-dashboard: backend port 8080 trusts x-forwarded-access-token without origin validation

Severity: high (CVSS 8.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.5% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-07-23 · updated 2026-10-24
Weakness: CWE-346

Description

A flaw was found in odh-dashboard, the web console component of Red Hat OpenShift AI (RHOAI). Due to incorrect network binding, a malicious actor within the cluster can bypass authentication and impersonate any user by providing an arbitrary access token. This allows an attacker to gain unauthorized access to the Kubernetes API, potentially leading to arbitrary code execution, privilege escalation, or information disclosure.

Affected products

Red Hat OpenShift AI 2.25: all versions — fixed in 1785940823, 1788312226
Red Hat OpenShift AI 3.3: all versions — fixed in 1786109683, 1790128681
Red Hat OpenShift AI 3.4: all versions — fixed in 1786109665, 1787347991

How to fix

Upgrade to a fixed version: Red Hat OpenShift AI 2.25 1785940823, 1788312226; Red Hat OpenShift AI 3.3 1786109683, 1790128681; Red Hat OpenShift AI 3.4 1786109665, 1787347991. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2026-16745 or the next vulnerability affects your stack