8.8
CVE-2026-18950
- EPSS 0.36%
- Veröffentlicht 10.08.2026 20:45:05
- Zuletzt bearbeitet 19.08.2026 11:16:46
- CVE-Watchlists
- Unerledigt
Odh-dashboard: odh-dashboard: confused-deputy privilege escalation via unchecked roleref in rolebinding creation
A flaw was found in odh-dashboard. An authenticated user of the dashboard can exploit a vulnerability related to how RoleBindings are created. The system does not properly validate the `roleRef` field, allowing a user to specify an arbitrary role, including highly privileged ones like `cluster-admin`. This can lead to privilege escalation, where an attacker gains unauthorized elevated access within their namespace and potentially persistent control over the system.
Daten sind bereitgestellt durch das CVE Programm von einer CVE Numbering Authority (CNA) (Unstrukturiert).
HerstellerRed Hat
≫
Produkt
Red Hat OpenShift AI 2.25
Default Statusaffected
Version
1785940823
Version <
*
Status
unaffected
HerstellerRed Hat
≫
Produkt
Red Hat OpenShift AI 3.3
Default Statusaffected
Version
1786109683
Version <
*
Status
unaffected
HerstellerRed Hat
≫
Produkt
Red Hat OpenShift AI 3.4
Default Statusaffected
Version
1786109665
Version <
*
Status
unaffected
HerstellerRed Hat
≫
Produkt
Red Hat OpenShift AI (RHOAI)
Default Statusunaffected
HerstellerRed Hat
≫
Produkt
Red Hat OpenShift AI (RHOAI)
Default Statusunaffected
HerstellerRed Hat
≫
Produkt
Red Hat OpenShift AI (RHOAI)
Default Statusunaffected
HerstellerRed Hat
≫
Produkt
Red Hat OpenShift AI (RHOAI)
Default Statusunaffected
HerstellerRed Hat
≫
Produkt
Red Hat OpenShift AI (RHOAI)
Default Statusunaffected
HerstellerRed Hat
≫
Produkt
Red Hat OpenShift AI (RHOAI)
Default Statusunaffected
HerstellerRed Hat
≫
Produkt
Red Hat OpenShift AI (RHOAI)
Default Statusunaffected
VulnDex Vulnerability Enrichment
Diese Information steht angemeldeten Benutzern zur Verfügung. 
Login
Login| Typ | Quelle | Score | Percentile |
|---|---|---|---|
| EPSS | FIRST.org | 0.36% | 0.29 |
| Quelle | Base Score | Exploit Score | Impact Score | Vector String |
|---|---|---|---|---|
| RedHat | 8.8 | 2.8 | 5.9 |
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
|
CWE-269 Improper Privilege Management
The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor.
https://access.redhat.com/security/cve/CVE-2026-18950
https://bugzilla.redhat.com/show_bug.cgi?id=2511170
https://access.redhat.com/errata/RHSA-2026:53263
https://access.redhat.com/errata/RHSA-2026:53261
https://access.redhat.com/errata/RHSA-2026:53262