Critical severity · published Apr 10, 2026
CVE-2026-5483
Odh-dashboard: odh dashboard kubernetes service account exposure
9.9
CVSS
0.5%
EPSS
No
On KEV
Description
A flaw was found in odh-dashboard in Red Hat Openshift AI. This vulnerability in the `odh-dashboard` component of Red Hat OpenShift AI (RHOAI) allows for the disclosure of Kubernetes Service Account tokens through a NodeJS endpoint. This could enable an attacker to gain unauthorized access to Kubernetes resources.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)0.5% · higher than 42% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
RH
Red Hat OpenShift AI 2.16 · Red Hat
All versions, or not specified · source: vendor, CISA
RH
Red Hat OpenShift AI 2.25 · Red Hat
All versions, or not specified · source: vendor, CISA
RH
Red Hat OpenShift AI 3.2 · Red Hat
All versions, or not specified · source: vendor, CISA
RH
Red Hat OpenShift AI 3.3 · Red Hat
All versions, or not specified · source: vendor, CISA
OA
Openshift AI · Redhat
2.16 before 2.16.4; 2.25 before 2.25.4; 3.2; 3.3 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-5483
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-5483
Vendor Advisory
https://access.redhat.com/errata/RHSA-2026:7397
Vendor Advisory
https://access.redhat.com/errata/RHSA-2026:7398
Vendor Advisory
https://access.redhat.com/errata/RHSA-2026:7403
Vendor Advisory
https://access.redhat.com/errata/RHSA-2026:7404
Vendor Advisory
https://access.redhat.com/security/cve/CVE-2026-5483
Issue Tracking
https://bugzilla.redhat.com/show_bug.cgi?id=2454764
More from Red Hat OpenShift AI 2.16
9.9
CVE-2025-10725
Openshift-ai: overly permissive clusterrole allows authenticated users to escalate privileges to cluster admin
7.5
CVE-2026-2229
undici is vulnerable to Unhandled Exception in undici WebSocket Client Due to Invalid server_max_window_bits Validation
7.5
CVE-2026-1528
undici is vulnerable to Malicious WebSocket 64-bit length overflows undici parser and crashes the client
7.5
CVE-2026-1526
undici is vulnerable to Unbounded Memory Consumption in undici WebSocket permessage-deflate Decompression
7.5
CVE-2026-32141
flatted: Unbounded recursion DoS in parse() revive phase