Odh-dashboard: odh-dashboard: nim credential secret readable by any authenticated user
- Published
- Last modified
- Where the record stands: published, rejected by its publisher, or superseded by another id.What do these mean? →
- published
- Whether CISA lists it in its Known Exploited Vulnerabilities catalog: proof that attackers are using it.What do these mean? →
- Not listed in CISA KEV
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- None on Exploit-DB, Metasploit or GitHub
- Exploitation: none
- Automatable: no
- Technical impact: partial
Summary
Odh-dashboard, the web dashboard component of Red Hat OpenShift AI, contains a flaw that lets any logged-in dashboard user read sensitive NVIDIA NIM credentials stored as Kubernetes Secrets, including the NGC API key and image pull secret. This could allow those users to access restricted credentials and potentially use them beyond their intended permissions.
Summarized by anthropic/claude-haiku-5.5. Verify details against the original sources.
Read the original description
A flaw was found in odh-dashboard in Red Hat OpenShift AI. The backend-for-frontend route GET /api/nim-serving/:nimResource reads Kubernetes Secrets using the dashboard service account and returns the full Secret object, including .data, without an authorization check. Any authenticated dashboard user can retrieve the cluster NVIDIA NGC API key Secret (apiKeySecret) and the NIM image pull secret (nimPullSecret). Create and delete of the same NIM credential are admin-gated; the read path is not. This is missing authorization (CWE-862) and insufficiently protected credentials (CWE-522). It is distinct from CVE-2026-5483 (service-account token leak in the Kubernetes client response wrapper on the same route) and CVE-2026-16456 (odh-model-controller cross-namespace confused deputy).
Timeline
- CVE published
- CISA SSVC assessment
Exploitation: none · Automatable: no · Technical impact: partial
- Record last updated
Affected versions
- rhoai/odh-dashboard-rhel9
Version range not reported
- rhoai/odh-dashboard-rhel9
Version range not reported
- rhoai/odh-core-bff-rhel9
Version range not reported
- rhoai/odh-dashboard-operator-rhel9
Version range not reported
- rhoai/odh-dashboard-rhel8
Version range not reported
- rhoai/odh-mod-arch-agent-ops-rhel9
Version range not reported
- rhoai/odh-mod-arch-automl-rhel9
Version range not reported
- rhoai/odh-mod-arch-autorag-rhel9
Version range not reported
- rhoai/odh-mod-arch-eval-hub-rhel9
Version range not reported
- rhoai/odh-mod-arch-gen-ai-rhel9
Version range not reported
- rhoai/odh-mod-arch-maas-rhel9
Version range not reported
- rhoai/odh-mod-arch-mlflow-rhel9
Version range not reported
- rhoai/odh-mod-arch-model-registry-rhel9
Version range not reported