Junglewise Threat Intelligence

CVE-2026-5483: Red Hat OpenShift AI token disclosure in odh-dashboard

CVE-2026-5483 · Severity: high · CVSS 8.5 · Published 2026-04-10

Vendors: Red Hat.

Executive brief

Red Hat OpenShift AI is a platform used by organizations to build, train, and deploy artificial intelligence models. A security flaw in its dashboard component could allow an authorized user to obtain sensitive internal access tokens. If exploited, an attacker could use these tokens to gain unauthorized control over the underlying Kubernetes infrastructure, potentially leading to data theft or service disruption.

Technical details

A vulnerability classified as CWE-201 (Insertion of Sensitive Information Into Sent Data) exists in the odh-dashboard component of Red Hat OpenShift AI. The flaw resides in a NodeJS endpoint that improperly exposes Kubernetes Service Account tokens. An attacker with low-privileged authenticated access can exploit this over the network to retrieve these tokens. Because the tokens are associated with service accounts, an attacker can leverage them to escalate privileges and perform unauthorized actions within the Kubernetes cluster. Red Hat has released security advisories (RHSA-2026:7397, RHSA-2026:7398, RHSA-2026:7403, RHSA-2026:7404) providing updated container images to mitigate this issue.

Affected products

  • Red Hat OpenShift AI 2.16 Fixed in 2.16.4
  • Red Hat OpenShift AI 2.25 Fixed in 2.25.4
  • Red Hat OpenShift AI 3.2 Fixed in 3.2.1
  • Red Hat OpenShift AI 3.3 Fixed in 3.3.1

Timeline

  • 2026-04-10: disclosed
  • 2026-04-10: advisory
  • 2026-04-10: patched

References