Skip to content
VulniPulse
Sign in
Advisory severityHigh8.8Vendor: CriticalRed Hat Linux

High [CVE-2026-18949] ClusterRole grants cluster-wide CRUD on secrets and RBAC management resources

This high-severity Red Hat Linux advisory covers CVE-2026-18949 affecting Red Hat OpenShift AI 2.25, Red Hat OpenShift AI 3.3, Red Hat OpenShift AI 3.4.

Aggregated and source-linked by VulniPulse. Data sources, validation and limitations.

CVE-2026-18949 Source published Source updated

VulniPulse record published Record updated

CVE-2026-18949
Affected products & platforms
Red Hat LinuxUnclassified
Open source advisory

Android app · Google Play

Monitor future Red Hat Linux CVEs from your phone.

Choose a whole vendor or a precise platform, then receive matching security advisories by phone notification, email, or both. Coverage follows 34 official vendor sources and 160+ reviewed platform categories.

Matching phone alertsOptional email delivery
Get CVE alertsSee app features

Summary

A flaw was found in odh-dashboard. This vulnerability allows an attacker, who has compromised the dashboard's Service Account (SA) token, to exploit overly broad permissions granted to the SA.

This enables the attacker to escalate their privileges to cluster-administrator level, gain access to sensitive data like credentials and keys across the entire cluster, and disrupt multi-tenant isolation.

A compromised dashboard Service Account could read and delete sensitive secrets across the cluster and create `ClusterRoleBindings`, leading to full cluster-admin privilege escalation and breaking multi-tenant isolation. This risk is present in Red Hat OpenShift AI deployments with the dashboard component enabled.

Red Hat severity: Critical — CVSS 8.8 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). Weakness: CWE-250.

Affected Red Hat products: Red Hat OpenShift AI 2.25; Red Hat OpenShift AI 3.3; Red Hat OpenShift AI 3.4; Red Hat OpenShift AI (RHOAI). Red Hat fixing advisory: RHSA-2026:53261, RHSA-2026:53263, RHSA-2026:53262.

Affected versions

No affected-version range was extracted from the source record. The vendor advisory is authoritative — check it before change work.

Official advisory · high-confidence parse· fetched 15 hours ago·verify at source

Fixed versions
  • rhoai/odh-dashboard-rhel9:1785940823
  • rhoai/odh-dashboard-rhel9:1786109683
  • rhoai/odh-dashboard-rhel9:1786109665
  • RHSA-2026:53261
  • RHSA-2026:53263
  • RHSA-2026:53262

Official advisory · high-confidence parse· fetched 15 hours ago·verify at source

Mitigation checklist

Recommended fix / mitigation
  • To mitigate this issue, restrict access to the `opendatahub` namespace to limit potential compromise of the dashboard pod. Implement egress `NetworkPolicy` rules to control and restrict outbound network traffic from the dashboard. Additionally, configure audit log alerting to monitor for and detect any unexpected creation of `ClusterRoleBindings` within the cluster.

Official advisory · high-confidence parse· fetched 15 hours ago·verify at source

Discussion(0)

No comments yet. Share field notes, upgrade gotchas, or questions — verify against the vendor advisory before acting on community advice.

Sign in to join the discussion.