EUVD-2026-55811
GHSA-w7qg-jg9c-w9mm
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Scope changed because the attacker exploits the controller's elevated cluster permissions to access secrets in namespaces outside their own authorization boundary.
Primary rating from Vendor (redhat).
CVSS VectorVendor: redhat
Lifecycle Timeline
1DescriptionCVE.org
A flaw was found in the odh-model-controller. An authenticated user with permissions to create custom resources can exploit a vulnerability in the loadSecret function. This function improperly reads the Secret namespace from user-controlled input without validation. This allows an attacker to read sensitive API keys and cloud credentials from other namespaces, leading to information disclosure.
AnalysisAI
Sensitive credential disclosure in Red Hat OpenShift AI's odh-model-controller component exposes Kubernetes Secrets - including cloud provider credentials and API keys - across namespace boundaries to any authenticated user holding custom resource creation permissions. The root cause is a confused deputy flaw (CWE-441) in the loadSecret function, which accepts user-controlled namespace input without validation, allowing the controller's elevated cluster-wide RBAC permissions to be turned against secrets in namespaces the attacker could not directly access. No public exploit code or CISA KEV listing is identified at time of analysis.
Technical ContextAI
The affected component is odh-model-controller, the Kubernetes operator backing Red Hat OpenShift AI (RHOAI), as identified by CPE cpe:2.3:a:red_hat:red_hat_openshift_ai_(rhoai):*:*:*:*:*:*:*:*. The root cause maps to CWE-441 (Unintended Proxy or Intermediary, commonly called the Confused Deputy problem): the controller runs with broad cluster-level RBAC permissions that permit it to read Kubernetes Secrets across multiple namespaces as part of its legitimate model-serving functions. The loadSecret function accepts a namespace value directly from fields within a user-submitted custom resource, then performs a Secret read against that namespace without verifying the requesting user holds authorization to access secrets in it. There is no cross-check between the requested namespace and the submitting user's own RBAC entitlements. The controller thus acts as a privileged proxy, fetching resources on behalf of a user who would be denied the same request if issued directly against the Kubernetes API.
RemediationAI
No specific fixed version is confirmed in the available data; patch availability should be tracked through the Red Hat advisory at https://access.redhat.com/security/cve/CVE-2026-16456 and Bugzilla entry https://bugzilla.redhat.com/show_bug.cgi?id=2503159. Patch available per vendor advisory should be applied as soon as a fixed RHOAI release is published. As a compensating control prior to patching, tighten RBAC by removing or restricting custom resource creation rights for odh-model-controller-managed resource types to only the users and service accounts that operationally require them - this directly gates who can reach the vulnerable loadSecret code path. Additionally, audit existing ClusterRoleBindings and RoleBindings to identify over-privileged users, and consider deploying OPA Gatekeeper or Kyverno admission policies to reject custom resource submissions containing namespace fields that reference namespaces other than the submitter's own. Note that RBAC restriction is the most effective interim control; admission policies add defense-in-depth but require policy authoring and testing to avoid breaking legitimate workflows.
More in Red Hat Openshift Ai Rhoai
View allThe Feast Feature Server contains a path traversal vulnerability in its `/read-document` endpoint that allows unauthenti
Unauthenticated remote code execution affects Feast (the open-source ML feature store), where user-defined functions sto
Authentication bypass in the Models-as-a-Service (MaaS) API component of Red Hat OpenShift AI (RHOAI) lets any pod alrea
Kubernetes Service Account token disclosure in the odh-dashboard component of Red Hat OpenShift AI (RHOAI) lets an authe
Server-side request forgery in the file_type content detector of guardrails-detectors (a component shipped with Red Hat
Arbitrary file write in the Feast Feature Server's `/save-document` endpoint lets an unauthenticated remote attacker wri
Privilege escalation in Red Hat OpenShift AI (RHOAI) training operator overlay allows any namespace editor to manage Tra
Privilege escalation in Red Hat OpenShift AI's training-operator enables any user holding a standard Kubernetes edit or
MySQL DSN parameter injection in Red Hat OpenShift AI's Data Science Pipelines Operator (DSPO) allows a namespace editor
Privilege escalation in odh-dashboard, the web interface for Red Hat OpenShift AI (RHOAI), allows any authenticated dash
Privilege escalation in odh-dashboard (Red Hat OpenShift AI) allows an attacker who has obtained the dashboard's Service
The MaaS (Model-as-a-Service) Gateway component in Red Hat OpenShift AI (RHOAI) is improperly configured, enabling any l
Same technique Information Disclosure
View allVendor StatusVendor
Share
External POC / Exploit Code
Leaving vuln.today