EUVD-2026-55811
GHSA-w7qg-jg9c-w9mm
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Scope changed because the attacker exploits the controller's elevated cluster permissions to access secrets in namespaces outside their own authorization boundary.
Primary rating from Vendor (redhat).
CVSS VectorVendor: redhat
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Lifecycle Timeline
1DescriptionCVE.org
A flaw was found in the odh-model-controller. An authenticated user with permissions to create custom resources can exploit a vulnerability in the loadSecret function. This function improperly reads the Secret namespace from user-controlled input without validation. This allows an attacker to read sensitive API keys and cloud credentials from other namespaces, leading to information disclosure.
AnalysisAI
Sensitive credential disclosure in Red Hat OpenShift AI's odh-model-controller component exposes Kubernetes Secrets - including cloud provider credentials and API keys - across namespace boundaries to any authenticated user holding custom resource creation permissions. The root cause is a confused deputy flaw (CWE-441) in the loadSecret function, which accepts user-controlled namespace input without validation, allowing the controller's elevated cluster-wide RBAC permissions to be turned against secrets in namespaces the attacker could not directly access. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires an authenticated account within the OpenShift cluster with RBAC rights to create the specific custom resource type that odh-model-controller processes - this is a non-default permission not granted to ordinary namespace users or unauthenticated parties. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The Red Hat-assigned CVSS 3.1 score of 6.5 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) captures the network-accessible, low-complexity nature of the exploit requiring only low-privilege authenticated access. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An authenticated OpenShift cluster user with RBAC permission to create the relevant RHOAI custom resource type submits a crafted manifest specifying a target namespace they do not own - such as a shared production secrets namespace - in the field consumed by loadSecret. The odh-model-controller, operating with cluster-wide Secret read privileges, fetches the designated secret and surfaces its contents, returning cloud provider access keys or external API tokens that the attacker could not retrieve via a direct Kubernetes API call. … |
| Remediation | No specific fixed version is confirmed in the available data; patch availability should be tracked through the Red Hat advisory at https://access.redhat.com/security/cve/CVE-2026-16456 and Bugzilla entry https://bugzilla.redhat.com/show_bug.cgi?id=2503159. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Red Hat Openshift Ai Rhoai
View allUnauthenticated remote code execution affects Feast (the open-source ML feature store), where user-defined functions sto
Authentication bypass in the Models-as-a-Service (MaaS) API component of Red Hat OpenShift AI (RHOAI) lets any pod alrea
Kubernetes Service Account token disclosure in the odh-dashboard component of Red Hat OpenShift AI (RHOAI) lets an authe
Server-side request forgery in the file_type content detector of guardrails-detectors (a component shipped with Red Hat
Arbitrary file write in the Feast Feature Server's `/save-document` endpoint lets an unauthenticated remote attacker wri
Privilege escalation in Red Hat OpenShift AI (RHOAI) training operator overlay allows any namespace editor to manage Tra
Privilege escalation in Red Hat OpenShift AI's training-operator enables any user holding a standard Kubernetes edit or
MySQL DSN parameter injection in Red Hat OpenShift AI's Data Science Pipelines Operator (DSPO) allows a namespace editor
Privilege escalation in odh-dashboard, the web interface for Red Hat OpenShift AI (RHOAI), allows any authenticated dash
Privilege escalation in odh-dashboard (Red Hat OpenShift AI) allows an attacker who has obtained the dashboard's Service
The MaaS (Model-as-a-Service) Gateway component in Red Hat OpenShift AI (RHOAI) is improperly configured, enabling any l
Authentication bypass in the odh-dashboard web console of Red Hat OpenShift AI (RHOAI) lets a low-privileged actor alrea
Same technique Information Disclosure
View allVendor StatusVendor
Share
External POC / Exploit Code
Leaving vuln.today