CVE-2026-18950: Odh-dashboard: odh-dashboard: confused-deputy privilege escalation via unchecked roleref in rolebinding creation

Severity: high (CVSS 8.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.5% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-08-10 · updated 2026-09-28
Weakness: CWE-266

Description

A flaw was found in odh-dashboard. An authenticated user of the dashboard can exploit a vulnerability related to how RoleBindings are created. The system does not properly validate the `roleRef` field, allowing a user to specify an arbitrary role, including highly privileged ones like `cluster-admin`. This can lead to privilege escalation, where an attacker gains unauthorized elevated access within their namespace and potentially persistent control over the system.

Affected products

Red Hat OpenShift AI 2.25: all versions — fixed in 1785940823
Red Hat OpenShift AI 3.3: all versions — fixed in 1786109683
Red Hat OpenShift AI 3.4: all versions — fixed in 1786109665

How to fix

Upgrade to a fixed version: Red Hat OpenShift AI 2.25 1785940823; Red Hat OpenShift AI 3.3 1786109683; Red Hat OpenShift AI 3.4 1786109665. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2026-18950 or the next vulnerability affects your stack