8.8

CVE-2026-16745

Odh-dashboard: odh-dashboard: backend port 8080 trusts x-forwarded-access-token without origin validation

A flaw was found in odh-dashboard, the web console component of Red Hat OpenShift AI (RHOAI). Due to incorrect network binding, a malicious actor within the cluster can bypass authentication and impersonate any user by providing an arbitrary access token. This allows an attacker to gain unauthorized access to the Kubernetes API, potentially leading to arbitrary code execution, privilege escalation, or information disclosure.
Daten sind bereitgestellt durch das CVE Programm von einer CVE Numbering Authority (CNA) (Unstrukturiert).
HerstellerRed Hat
≫
Produkt Red Hat OpenShift AI 2.25
Default Statusaffected
Version 1785940823
Version < *
Status unaffected
HerstellerRed Hat
≫
Produkt Red Hat OpenShift AI 3.3
Default Statusaffected
Version 1786109683
Version < *
Status unaffected
HerstellerRed Hat
≫
Produkt Red Hat OpenShift AI 3.4
Default Statusaffected
Version 1786109665
Version < *
Status unaffected
VulnDex Vulnerability Enrichment
Diese Information steht angemeldeten Benutzern zur Verfügung. Login Login
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.27% 0.189
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
RedHat 8.8 2.8 5.9
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CWE-346 Origin Validation Error

The product does not properly verify that the source of data or communication is valid.

https://access.redhat.com/security/cve/CVE-2026-16745
https://bugzilla.redhat.com/show_bug.cgi?id=2506350
https://access.redhat.com/errata/RHSA-2026:53263
https://access.redhat.com/errata/RHSA-2026:53261
https://access.redhat.com/errata/RHSA-2026:53262