EUVD-2026-60199
GHSA-xpxj-568j-277q
Severity by source
AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:L
High privileges required to obtain ServiceAccount token; attack complexity high due to chained access prerequisite; scope changes to cluster-wide on success.
Primary rating from Vendor (redhat).
CVSS VectorVendor: redhat
Lifecycle Timeline
2DescriptionCVE.org
A flaw was found in the maas-api and maas-controller ServiceAccounts within Red Hat OpenShift AI. These ServiceAccounts are granted cluster-wide permissions that exceed their operational requirements. An attacker who compromises the identity of these ServiceAccounts, either through a remote code execution vulnerability or by creating a malicious pod in the same namespace, could exploit these excessive permissions. This could lead to full cluster administrator privileges through the creation of new ClusterRoleBindings or the disclosure of sensitive information by accessing all secrets across the cluster.
AnalysisAI
Excessive RBAC permissions on the maas-api and maas-controller ServiceAccounts in Red Hat OpenShift AI enable privilege escalation to full cluster administrator. An attacker who compromises either ServiceAccount identity - by exploiting a separate RCE vulnerability within those pods or by creating a malicious pod in the same Kubernetes namespace - can create new ClusterRoleBindings to assume cluster-admin rights or read all secrets across the cluster. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires one of two specific preconditions: (1) a separate exploitable RCE vulnerability present in the maas-api or maas-controller pods that grants code execution within those pods, thereby providing access to the ServiceAccount token mounted on the pod filesystem; or (2) pre-existing Kubernetes RBAC privileges permitting pod creation within the same namespace as the maas-api or maas-controller components, enabling deployment of a malicious pod that can read the ServiceAccount token. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 7.9 score is driven primarily by the Scope:Changed metric and the high confidentiality and integrity impacts, reflecting that a successful exploit crosses the namespace boundary to affect the entire cluster. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Apply the vendor-released patch per the Red Hat security advisory at https://access.redhat.com/security/cve/CVE-2026-15218; an exact fixed version is not independently confirmed from the available data, so consult the advisory directly. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, audit the RBAC permissions assigned to maas-api and maas-controller ServiceAccounts in all OpenShift AI environments and document current ClusterRoleBindings. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-266 – Incorrect Privilege Assignment
View allVendor StatusVendor
Share
External POC / Exploit Code
Leaving vuln.today