EUVD-2026-55808
GHSA-6vf6-rmwh-84qg
Severity by source
AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
PR:L for the required in-cluster pod foothold, AC:L because forging two static headers is trivial, and S:C because the header-trust bypass breaks isolation into other tenants' namespaces with full C/I/A impact.
Primary rating from Vendor (redhat).
CVSS VectorVendor: redhat
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Lifecycle Timeline
2DescriptionCVE.org
A flaw was found in the MaaS API. This vulnerability allows any pod within the cluster to bypass the Kuadrant AuthPolicy gateway by forging HTTP headers, specifically X-MaaS-Username and X-MaaS-Group, which are trusted verbatim. This lack of first-party authentication enables an attacker to gain unauthorized access and escalate privileges. The concrete consequences include the ability to mint Kubernetes ServiceAccount tokens in other tenants' namespaces, revoke API keys, and exfiltrate sensitive model access configuration.
Articles & Coverage 2
AnalysisAI
Authentication bypass in the Models-as-a-Service (MaaS) API component of Red Hat OpenShift AI (RHOAI) lets any pod already running in the cluster impersonate arbitrary users by forging the X-MaaS-Username and X-MaaS-Group HTTP headers, which the service trusts without independent verification. Because the MaaS API performs no first-party authentication and defers entirely to a Kuadrant AuthPolicy gateway that can be circumvented, a low-privileged workload can mint Kubernetes ServiceAccount tokens in other tenants' namespaces, revoke API keys, and exfiltrate model-access configuration - a full cross-tenant privilege escalation. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires the attacker to control a workload (pod) inside the OpenShift/Kubernetes cluster hosting RHOAI - this is the PR:L foothold, achievable via a legitimate tenant workload or any compromised pod - and network reachability to the MaaS API service that bypasses the Kuadrant AuthPolicy gateway (i.e., direct pod-to-service traffic is not blocked by NetworkPolicy). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This is a genuine high-priority issue, not a CVSS-inflated one. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker who has compromised or legitimately deployed a single low-privilege pod in a shared RHOAI cluster sends an HTTP request directly to the MaaS API service, adding X-MaaS-Username and X-MaaS-Group headers naming a victim tenant's administrator. The MaaS API accepts the forged identity and mints a Kubernetes ServiceAccount token in the victim's namespace, which the attacker then uses to read model configuration, revoke the tenant's API keys, and pivot deeper. … |
| Remediation | Apply the Red Hat-provided fix once the erratum is published; the reference https://access.redhat.com/security/cve/CVE-2026-14450 is the canonical source for the fixed RHOAI/MaaS component version, which is not enumerated in the supplied data (Patch available per vendor advisory; exact fixed version not independently confirmed here). … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: Inventory all Red Hat OpenShift AI deployments and identify multi-tenant configurations; assess current tenant isolation controls and determine blast radius. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Kubernetes
View allA critical vulnerability in Kubernetes ingress-nginx controller allows unauthenticated attackers with pod network access
Credential-harvesting malware compromised 84 versions of 42 TanStack npm packages on 2026-05-11 via chained GitHub Actio
Kubernetes ingress-nginx contains a configuration injection vulnerability via the mirror-target and mirror-host Ingress
A security issue was discovered in ingress-nginx https://github.com/kubernetes/ingress-nginx where the `auth-url` Ingres
A security issue was discovered in ingress-nginx https://github.com/kubernetes/ingress-nginx where the `auth-tls-match-c
Kubernetes API server in all versions allow an attacker who is able to create a ClusterIP service and set the spec.exter
A security issue was discovered in Kubernetes where a user that can create pods on Windows nodes may be able to escalate
Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. Rated critical severity (CVSS 9.9), this vulne
Unauthenticated remote attackers can trigger complete database overwrites, server-side file reads, and SSRF attacks agai
The Kubernetes integration in GitLab Enterprise Edition 11.x before 11.2.8, 11.3.x before 11.3.9, and 11.4.x before 11.4
Fluentd configuration injection in the kube-logging Logging operator before 6.6.0 allows a namespace-scoped user who can
Kyverno Kubernetes policy engine prior to 1.x has a privilege escalation vulnerability (CVSS 9.9) allowing policy bypass
Same weakness CWE-290 – Authentication Bypass by Spoofing
View allSame technique Authentication Bypass
View allVendor StatusVendor
Share
External POC / Exploit Code
Leaving vuln.today