CVE-2026-16745
Full vulnerability record from the local CVENow database.
Description
A flaw was found in odh-dashboard, the web console component of Red Hat OpenShift AI (RHOAI). Due to incorrect network binding, a malicious actor within the cluster can bypass authentication and impersonate any user by providing an arbitrary access token. This allows an attacker to gain unauthorized access to the Kubernetes API, potentially leading to arbitrary code execution, privilege escalation, or information disclosure.
Severity
HIGH
CVSS score
8.8
(v3.1)
Vulnerability status
Awaiting Analysis
Source identifier
Published
2026-07-23 11:16:40.043000
Last modified
2026-10-24 13:10:00.147000
View original CVE JSON
{
"id": "CVE-2026-16745",
"sourceIdentifier": "[email protected]",
"published": "2026-07-23T11:16:40.043",
"lastModified": "2026-10-24T13:10:00.147",
"vulnStatus": "Awaiting Analysis",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "A flaw was found in odh-dashboard, the web console component of Red Hat OpenShift AI (RHOAI). Due to incorrect network binding, a malicious actor within the cluster can bypass authentication and impersonate any user by providing an arbitrary access token. This allows an attacker to gain unauthorized access to the Kubernetes API, potentially leading to arbitrary code execution, privilege escalation, or information disclosure."
},
{
"lang": "es",
"value": "Se encontró una falla en odh-dashboard, el componente de consola web de Red Hat OpenShift AI (RHOAI). Debido a una vinculación de red incorrecta, un actor malicioso dentro del clúster puede omitir la autenticación e suplantar a cualquier usuario al proporcionar un token de acceso arbitrario. Esto permite a un atacante obtener acceso no autorizado a la API de Kubernetes, lo que podría llevar a ejecución de código arbitrario, escalada de privilegios o revelación de información."
}
],
"affected": [
{
"source": "[email protected]",
"affectedData": [
{
"vendor": "Red Hat",
"product": "Red Hat OpenShift AI 2.25",
"defaultStatus": "affected",
"collectionURL": "https://catalog.redhat.com/software/containers/",
"packageName": "rhoai/odh-dashboard-rhel9",
"cpes": [
"cpe:/a:redhat:openshift_ai:2.25::el9"
],
"versions": [
{
"version": "1785940823",
"lessThan": "*",
"versionType": "rpm",
"status": "unaffected"
}
]
},
{
"vendor": "Red Hat",
"product": "Red Hat OpenShift AI 2.25",
"defaultStatus": "affected",
"collectionURL": "https://catalog.redhat.com/software/containers/",
"packageName": "rhoai/odh-dashboard-rhel9",
"cpes": [
"cpe:/a:redhat:openshift_ai:2.25::el9"
],
"versions": [
{
"version": "1788312226",
"lessThan": "*",
"versionType": "rpm",
"status": "unaffected"
}
]
},
{
"vendor": "Red Hat",
"product": "Red Hat OpenShift AI 3.3",
"defaultStatus": "affected",
"collectionURL": "https://catalog.redhat.com/software/containers/",
"packageName": "rhoai/odh-dashboard-rhel9",
"cpes": [
"cpe:/a:redhat:openshift_ai:3.3::el9"
],
"versions": [
{
"version": "1786109683",
"lessThan": "*",
"versionType": "rpm",
"status": "unaffected"
}
]
},
{
"vendor": "Red Hat",
"product": "Red Hat OpenShift AI 3.3",
"defaultStatus": "affected",
"collectionURL": "https://catalog.redhat.com/software/containers/",
"packageName": "rhoai/odh-dashboard-rhel9",
"cpes": [
"cpe:/a:redhat:openshift_ai:3.3::el9"
],
"versions": [
{
"version": "1790128681",
"lessThan": "*",
"versionType": "rpm",
"status": "unaffected"
}
]
},
{
"vendor": "Red Hat",
"product": "Red Hat OpenShift AI 3.4",
"defaultStatus": "affected",
"collectionURL": "https://catalog.redhat.com/software/containers/",
"packageName": "rhoai/odh-dashboard-rhel9",
"cpes": [
"cpe:/a:redhat:openshift_ai:3.4::el9"
],
"versions": [
{
"version": "1786109665",
"lessThan": "*",
"versionType": "rpm",
"status": "unaffected"
}
]
},
{
"vendor": "Red Hat",
"product": "Red Hat OpenShift AI 3.4",
"defaultStatus": "affected",
"collectionURL": "https://catalog.redhat.com/software/containers/",
"packageName": "rhoai/odh-dashboard-rhel9",
"cpes": [
"cpe:/a:redhat:openshift_ai:3.4::el9"
],
"versions": [
{
"version": "1787347991",
"lessThan": "*",
"versionType": "rpm",
"status": "unaffected"
}
]
}
]
}
],
"metrics": {
"cvssMetricV31": [
{
"source": "[email protected]",
"type": "Secondary",
"cvssData": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "LOW",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"availabilityImpact": "HIGH"
},
"exploitabilityScore": 2.8,
"impactScore": 5.9
}
],
"ssvcV203": [
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"ssvcData": {
"timestamp": "2026-07-23T13:53:29.776641Z",
"id": "CVE-2026-16745",
"options": [
{
"exploitation": "none"
},
{
"automatable": "no"
},
{
"technicalImpact": "total"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
]
},
"weaknesses": [
{
"source": "[email protected]",
"type": "Secondary",
"description": [
{
"lang": "en",
"value": "CWE-346"
}
]
}
],
"references": [
{
"url": "https://access.redhat.com/errata/RHSA-2026:53261",
"source": "[email protected]"
},
{
"url": "https://access.redhat.com/errata/RHSA-2026:53262",
"source": "[email protected]"
},
{
"url": "https://access.redhat.com/errata/RHSA-2026:53263",
"source": "[email protected]"
},
{
"url": "https://access.redhat.com/errata/RHSA-2026:60520",
"source": "[email protected]"
},
{
"url": "https://access.redhat.com/errata/RHSA-2026:65126",
"source": "[email protected]"
},
{
"url": "https://access.redhat.com/errata/RHSA-2026:73987",
"source": "[email protected]"
},
{
"url": "https://access.redhat.com/security/cve/CVE-2026-16745",
"source": "[email protected]"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2506350",
"source": "[email protected]"
}
]
}