CVE-2026-18949highCWE-250

CVE-2026-18949: falha de alta gravidade em Red Hat OpenShift AI 2.25

Odh-dashboard: odh-dashboard: clusterrole grants cluster-wide crud on secrets and rbac management resources

Publicada em · Atualizada em

Seguir esta CVE+ Monitorar Red Hat OpenShift AI

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

21Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 8.8epss 0.7%
A flaw was found in odh-dashboard. This vulnerability allows an attacker, who has compromised the dashboard's Service Account (SA) token, to exploit overly broad permissions granted to the SA. This enables the attacker to escalate their privileges to cluster-administrator level, gain access to sensitive data like credentials and keys across the entire cluster, and disrupt multi-tenant isolation.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Produtos afetados
Red Hat · Red Hat OpenShift AI 2.25Red Hat · Red Hat OpenShift AI 3.3Red Hat · Red Hat OpenShift AI 3.4
CVEs relacionadas — Red Hat OpenShift AI 2.25

No mesmo produto, das mais perigosas para as menos.

CVE-2026-33845HIGHGnutls: gnutls: denial of service via dtls zero-length fragmentEPSS 2.1%CVE-2023-52355HIGHLibtiff: tiffrasterscanlinesize64 produce too-big size and could cause oomEPSS 1.8%CVE-2026-42009HIGHGnutls: gnutls: denial of service via dtls packet reordering vulnerabilityEPSS 1.3%CVE-2026-33846HIGHGnutls: gnutls: denial of service via heap buffer overflow in dtls handshake fragment reassemblyEPSS 1.3%CVE-2026-18948CRITICALFeast: feast: unsafe dill deserialization of registry-stored udfs — rce on feature server and registry serverEPSS 1.1%CVE-2026-42010HIGHGnutls: gnutls: authentication bypass via nul character in usernameEPSS 1.1%