Read the docs
TI-2026-04802 Aliases CVE-2026-5483GHSA-w59f-v72r-w493

Odh-dashboard: odh dashboard kubernetes service account exposure

Priority MEDIUM 43CWE-201Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
Information disclosure
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA and Red Hat. Impact type from CWE-201.

Summary

A flaw was found in odh-dashboard in Red Hat Openshift AI. This vulnerability in the `odh-dashboard` component of Red Hat OpenShift AI (RHOAI) allows for the disclosure of Kubernetes Service Account tokens through a NodeJS endpoint. This could enable an attacker to gain unauthorized access to Kubernetes resources.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.005 43rd percentileScored 2026-11-07
Fix Fixed Red Hat: 4 advisories

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
Red HatRed Hat OpenShift AI 2.16—1775230902Patch availableCNA
Red HatRed Hat OpenShift AI 2.25—1775234711Patch availableCNA
Red HatRed Hat OpenShift AI 3.2—1775523049Patch availableCNA
Red HatRed Hat OpenShift AI 3.3—1775239958Patch availableCNA
Red HatRed Hat OpenShift AI (RHOAI)——Not affectedCNA
Red HatRed Hat OpenShift AI (RHOAI)——Not affectedCNA
Red HatRed Hat OpenShift AI (RHOAI)——Not affectedCNA
  • Red Hat OpenShift AI 2.16 VendorRed Hat Affected — Fixed in 1775230902 Patch available CNA
  • Red Hat OpenShift AI 2.25 VendorRed Hat Affected — Fixed in 1775234711 Patch available CNA
  • Red Hat OpenShift AI 3.2 VendorRed Hat Affected — Fixed in 1775523049 Patch available CNA
  • Red Hat OpenShift AI 3.3 VendorRed Hat Affected — Fixed in 1775239958 Patch available CNA
  • Red Hat OpenShift AI (RHOAI) VendorRed Hat Affected — Fixed in — Not affected CNA
  • Red Hat OpenShift AI (RHOAI) VendorRed Hat Affected — Fixed in — Not affected CNA
  • Red Hat OpenShift AI (RHOAI) VendorRed Hat Affected — Fixed in — Not affected CNA

CPE configurations NVD · 3

CPEVersionsRoleVendor
cpe:2.3:a:redhat:openshift_ai:*:*:*:*:*:*:*:*2.16 to before 2.16.4; 2.25 to before 2.25.4VulnerableRed Hat
cpe:2.3:a:redhat:openshift_ai:3.2:*:*:*:*:*:*:*3.2VulnerableRed Hat
cpe:2.3:a:redhat:openshift_ai:3.3:*:*:*:*:*:*:*3.3VulnerableRed Hat
  • cpe:2.3:a:redhat:openshift_ai:*:*:*:*:*:*:*:* Versions 2.16 to before 2.16.4; 2.25 to before 2.25.4 Vulnerable ·Red Hat
  • cpe:2.3:a:redhat:openshift_ai:3.2:*:*:*:*:*:*:* Versions 3.2 Vulnerable ·Red Hat
  • cpe:2.3:a:redhat:openshift_ai:3.3:*:*:*:*:*:*:* Versions 3.3 Vulnerable ·Red Hat

Remediation

Red Hat 4 advisories

  • RHSA-2026:7404 Released 2026-04-10 · Red Hat rating Important
    RHOAI 3.2 - Red Hat OpenShift AI
    • Red Hat OpenShift AI 3.2 registry.redhat.io/rhoai/odh-dashboard-rhel9
  • RHSA-2026:7403 Released 2026-04-10 · Red Hat rating Important
    RHOAI 3.3.1 - Red Hat OpenShift AI
    • Red Hat OpenShift AI 3.3 registry.redhat.io/rhoai/odh-dashboard-rhel9
  • RHSA-2026:7398 Released 2026-04-10 · Red Hat rating Important
    RHOAI 2.25.4 - Red Hat OpenShift AI
    • Red Hat OpenShift AI 2.25 registry.redhat.io/rhoai/odh-dashboard-rhel9
Show 1 more Red Hat advisories
  • RHSA-2026:7397 Released 2026-04-10 · Red Hat rating Important
    RHOAI 2.16.4 - Red Hat OpenShift AI
    • Red Hat OpenShift AI 2.16 registry.redhat.io/rhoai/odh-dashboard-rhel8

Vendor assessments

Red Hat

Red Hat rating: Important. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat OpenShift AI 2.16Fixed RHSA-2026:7397
Red Hat OpenShift AI 2.25Fixed RHSA-2026:7398
Red Hat OpenShift AI 3.2Fixed RHSA-2026:7404
Red Hat OpenShift AI 3.3Fixed RHSA-2026:7403
Not affected: 5 products
  • Red Hat OpenShift AI (RHOAI)
  • Red Hat OpenShift AI 2.16
  • Red Hat OpenShift AI 2.25
  • Red Hat OpenShift AI 3.2
  • Red Hat OpenShift AI 3.3

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-5483
  2. 2026-10-03 Alias added: GHSA-w59f-v72r-w493
  3. 2026-10-14 EPSS moved to the 50th–90th percentile
  4. 2026-10-25 EPSS moved to the below the 50th percentile

References

Advisory 6

  • TI-2026-30582 LiteLLM: Authenticated command execution via MCP stdio test endpoints KEVCVSS 4.0HIGH 8.7
  • TI-2026-35991 Starlette has missing Host header validation that poisons request.url.path, bypassing path-based security checks KEVCVSS 3.1MEDIUM 6.5
  • TI-2026-01159 Safe Mode Bypass in keras-team/keras CVSS 3.0HIGH 8.8
  • TI-2026-34281 JavaScript Cookie: Per-instance prototype hijack in assign() enables cookie-attribute injection CVSS 3.1HIGH 7.5
  • TI-2026-28834 jq: Out-of-Bounds Read in jv_parse_sized() Error Formatting for Non-NUL-Terminated Counted Buffers CVSS 4.0MEDIUM 6.9
  • TI-2026-41777 Glib: integer underflow in gio/gdbusintrospection.c via "g_dbus_node_info_new_for_xml" CVSS 3.1CRITICAL 9.1
See all 11 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences