CVE-2026-16745highCWE-346

CVE-2026-16745: falha de alta gravidade em Red Hat OpenShift AI 2.25

Odh-dashboard: odh-dashboard: backend port 8080 trusts x-forwarded-access-token without origin validation

Publicada em · Atualizada em

Seguir esta CVE+ Monitorar Red Hat OpenShift AI

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

21Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 8.8epss 0.5%
A flaw was found in odh-dashboard, the web console component of Red Hat OpenShift AI (RHOAI). Due to incorrect network binding, a malicious actor within the cluster can bypass authentication and impersonate any user by providing an arbitrary access token. This allows an attacker to gain unauthorized access to the Kubernetes API, potentially leading to arbitrary code execution, privilege escalation, or information disclosure.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Produtos afetados
Red Hat · Red Hat OpenShift AI 2.25Red Hat · Red Hat OpenShift AI 3.3Red Hat · Red Hat OpenShift AI 3.4
CVEs relacionadas — Red Hat OpenShift AI 2.25

No mesmo produto, das mais perigosas para as menos.

CVE-2026-33845HIGHGnutls: gnutls: denial of service via dtls zero-length fragmentEPSS 2.1%CVE-2023-52355HIGHLibtiff: tiffrasterscanlinesize64 produce too-big size and could cause oomEPSS 1.8%CVE-2026-42009HIGHGnutls: gnutls: denial of service via dtls packet reordering vulnerabilityEPSS 1.3%CVE-2026-33846HIGHGnutls: gnutls: denial of service via heap buffer overflow in dtls handshake fragment reassemblyEPSS 1.3%CVE-2026-18948CRITICALFeast: feast: unsafe dill deserialization of registry-stored udfs — rce on feature server and registry serverEPSS 1.1%CVE-2026-42010HIGHGnutls: gnutls: authentication bypass via nul character in usernameEPSS 1.1%