CVE-2026-18949: Odh-dashboard: odh-dashboard: clusterrole grants cluster-wide crud on secrets and rbac management resources

Severity: high (CVSS 8.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.7% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-08-10 · updated 2026-10-22
Weakness: CWE-250

Description

A flaw was found in odh-dashboard. This vulnerability allows an attacker, who has compromised the dashboard's Service Account (SA) token, to exploit overly broad permissions granted to the SA. This enables the attacker to escalate their privileges to cluster-administrator level, gain access to sensitive data like credentials and keys across the entire cluster, and disrupt multi-tenant isolation.

Affected products

Red Hat OpenShift AI 2.25: all versions — fixed in 1785940823, 1791853432
Red Hat OpenShift AI 3.3: all versions — fixed in 1786109683
Red Hat OpenShift AI 3.4: all versions — fixed in 1786109665, 1791860708, 1791860918, 1791860994, 1791861032, 1791861214

How to fix

Upgrade to a fixed version: Red Hat OpenShift AI 2.25 1785940823, 1791853432; Red Hat OpenShift AI 3.3 1786109683; Red Hat OpenShift AI 3.4 1786109665, 1791860708, 1791860918, 1791860994. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2026-18949 or the next vulnerability affects your stack