CVE-2024-7557
CVE.org · Published
- Record status
- Published
- Identifier year (not publication year)
- 2024
- Source publication
- Source updated
- Imported by cveboard
- Source snapshot
- cve_2026-10-24_midnight_baseline ·
CNA source text (English)
Odh-dashboard: odh-model-controller: cross-model authentication bypass in openshift ai
A vulnerability was found in OpenShift AI that allows for authentication bypass and privilege escalation across models within the same namespace. When deploying AI models, the UI provides the option to protect models with authentication. However, credentials from one model can be used to access other models and APIs within the same namespace. The exposed ServiceAccount tokens, visible in the UI, can be utilized with oc --token={token} to exploit the elevated view privileges associated with the ServiceAccount, leading to unauthorized access to additional resources.
Scoped product and version facts
Fix information unknown; no fixed version is derived here. Missing information does not prove that no fix exists.
Exploitation unknown; this catalogue does not assess exploitation.
odh-dashboard
- Vendor
- Unknown
- Product
- Unknown
- Platforms
- Unknown
- Default status
unknown- Package
- odh-dashboard
- Package collection
- https://github.com/opendatahub-io/odh-dashboard
| Version (version) | Status (status) | Version scheme (versionType) | Exclusive end (lessThan) | Inclusive end (lessThanOrEqual) | Status changes (at → status) |
|---|---|---|---|---|---|
| 2.8.* | affected | semver | Unavailable | Unavailable | None listed |
| 2.11 | affected | semver | Unavailable | Unavailable | None listed |
| a122ad06a297f4e8b2a065eece910aa882cc3fa6 | unaffected | git | Unavailable | Unavailable | None listed |
Red Hat OpenShift AI (RHOAI)
- Vendor
- Red Hat
- Product
- Red Hat OpenShift AI (RHOAI)
- Platforms
- Unknown
- Default status
affected- Package
- odh-dashboard-container
- Package collection
- https://catalog.redhat.com/software/containers/
No explicit version tuples; consult this entry's default status.
Red Hat OpenShift AI (RHOAI)
- Vendor
- Red Hat
- Product
- Red Hat OpenShift AI (RHOAI)
- Platforms
- Unknown
- Default status
affected- Package
- odh-model-controller-container
- Package collection
- https://catalog.redhat.com/software/containers/
No explicit version tuples; consult this entry's default status.
Red Hat OpenShift Data Science (RHODS)
- Vendor
- Red Hat
- Product
- Red Hat OpenShift Data Science (RHODS)
- Platforms
- Unknown
- Default status
affected- Package
- rhods/odh-dashboard-rhel8
- Package collection
- https://access.redhat.com/downloads/content/package-browser/
No explicit version tuples; consult this entry's default status.
Red Hat OpenShift Data Science (RHODS)
- Vendor
- Red Hat
- Product
- Red Hat OpenShift Data Science (RHODS)
- Platforms
- Unknown
- Default status
affected- Package
- rhods/odh-model-controller-rhel8
- Package collection
- https://access.redhat.com/downloads/content/package-browser/
No explicit version tuples; consult this entry's default status.