What is the CVSS score of EUVD-2026-55820?

EUVD-2026-55820 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.4%.

Which versions of odh-dashboard are affected by EUVD-2026-55820?

A privilege escalation vulnerability in Red Hat OpenShift AI's dashboard (CVE-2026-18950) allows authenticated dashboard users to assume cluster-wide administrative privileges, gaining full control…. A patch is available.

How to fix or mitigate EUVD-2026-55820?

Within 24 hours, identify all Red Hat OpenShift AI deployments, audit current dashboard users, and immediately restrict network access to the dashboard using firewall rules and Kubernetes ingress policies, limiting access to essential administrators only. Within 7 days, implement enhanced audit logging for Kubernetes role assignments, deploy policy-as-code (such as OPA/Gatekeeper) to restrict RoleBinding modifications, and establish daily review procedures for privileged role assignments. Within 30 days, monitor Red Hat security advisories for patch release and apply immediately upon availability; in parallel, conduct comprehensive access reviews to enforce least-privilege principles for dashboard users and evaluate alternative tools or feature disablement if patch availability extends beyond 60 days.

odh-dashboard EUVD-2026-55820

| CVE-2026-18950 HIGH

Improper Privilege Management (CWE-269)

2026-08-10 redhat

GHSA-jcjp-44w9-2wwj

Privilege Escalation Red Hat Openshift Ai Rhoai Red Hat

8.8

CVSS 3.1 · Vendor: redhat

Severity by source

Vendor (redhat) PRIMARY

8.8 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

9.9 CRITICAL

Scope Changed because successfully binding to cluster-admin escapes namespace boundaries, granting control over the entire OpenShift cluster beyond the vulnerable component.

3.1 AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

Red Hat

8.8 CRITICAL

qualitative

Primary rating from Vendor (redhat).

CVSS VectorVendor: redhat

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Aug 10, 2026 - 21:26 vuln.today

CVE Published

Aug 10, 2026 - 20:45 nvd

HIGH 8.8

DescriptionCVE.org

A flaw was found in odh-dashboard. An authenticated user of the dashboard can exploit a vulnerability related to how RoleBindings are created. The system does not properly validate the roleRef field, allowing a user to specify an arbitrary role, including highly privileged ones like cluster-admin. This can lead to privilege escalation, where an attacker gains unauthorized elevated access within their namespace and potentially persistent control over the system.

AnalysisAI

Privilege escalation in odh-dashboard, the web interface for Red Hat OpenShift AI (RHOAI), allows any authenticated dashboard user to gain cluster-admin or other highly privileged roles by manipulating the roleRef field when creating RoleBindings. The system performs no server-side validation on the roleRef value supplied through the dashboard, enabling an attacker holding only a standard user account to bind themselves to arbitrary Kubernetes ClusterRoles. No public exploit code has been identified at time of analysis and the vulnerability is not listed in the CISA KEV catalog, but the CVSS 8.8 score and the direct, low-complexity path to cluster-admin access make this a high-priority remediation target for any RHOAI deployment.

Technical ContextAI

odh-dashboard is the web UI component of Red Hat OpenShift AI (RHOAI), Red Hat's managed AI/ML platform built on OpenShift (Kubernetes). RoleBindings are a core Kubernetes RBAC primitive that associate subjects (users, groups, service accounts) with roles scoped to a namespace; their roleRef field names the target Role or ClusterRole. When odh-dashboard facilitates or proxies RoleBinding creation on behalf of users, it must enforce an allowlist of permissible roleRef values - failing to do so is an authorization bypass that lets the caller reference any role in the cluster, including the ClusterRole cluster-admin. The affected product is identified by CPE cpe:2.3:a:red_hat:red_hat_openshift_ai_(rhoai):*:*:*:*:*:*:*:* across multiple version entries, indicating broad applicability across RHOAI releases. No formal CWE is assigned in the advisory, but the root cause maps to improper authorization (CWE-285) and missing server-side validation of a security-critical field (CWE-20).

RemediationAI

Consult the Red Hat security advisory at https://access.redhat.com/security/cve/CVE-2026-18950 for the official patch and upgrade instructions; no specific fixed version number is confirmed from the available data, so the advisory must be checked directly for patched release details. Until a patch is applied, consider restricting or disabling the RoleBinding creation feature within odh-dashboard by tightening RBAC permissions on the service account or API proxy the dashboard uses - preventing the dashboard from creating RoleBindings that reference ClusterRoles breaks the exploit path, though it may impact legitimate administrative workflows and should be tested against operational requirements. Additionally, audit all existing RoleBindings within RHOAI namespaces for unexpected high-privilege roleRef values, particularly any referencing cluster-admin, and review OpenShift audit logs for anomalous RoleBinding creation events as an indicator of prior exploitation. Limiting dashboard access to a minimal trusted user set reduces the exposed attack surface in the interim.