CVE-2026-16745

CVE.org · Published

Record status: Published
Identifier year (not publication year): 2026
Source publication: Jul 23, 2026
Source updated: Sep 30, 2026
Imported by cveboard: Oct 24, 2026
Source snapshot: cve_2026-10-24_midnight_baseline · Oct 24, 2026

CNA source text (English)

Odh-dashboard: odh-dashboard: backend port 8080 trusts x-forwarded-access-token without origin validation

A flaw was found in odh-dashboard, the web console component of Red Hat OpenShift AI (RHOAI). Due to incorrect network binding, a malicious actor within the cluster can bypass authentication and impersonate any user by providing an arbitrary access token. This allows an attacker to gain unauthorized access to the Kubernetes API, potentially leading to arbitrary code execution, privilege escalation, or information disclosure.

Scoped product and version facts

Fix information unknown; no fixed version is derived here. Missing information does not prove that no fix exists.

Exploitation unknown; this catalogue does not assess exploitation.

Red Hat OpenShift AI 2.25

Vendor: Red Hat
Product: Red Hat OpenShift AI 2.25
Platforms: Unknown
Default status: affected
Package: rhoai/odh-dashboard-rhel9
Package collection: https://catalog.redhat.com/software/containers/

Red Hat OpenShift AI 2.25 · Scoped product and version facts
Version (version)	Status (status)	Version scheme (versionType)	Exclusive end (lessThan)	Inclusive end (lessThanOrEqual)	Status changes (at → status)
1785940823	`unaffected`	rpm	*	Unavailable	None listed

Red Hat OpenShift AI 2.25

Vendor: Red Hat
Product: Red Hat OpenShift AI 2.25
Platforms: Unknown
Default status: affected
Package: rhoai/odh-dashboard-rhel9
Package collection: https://catalog.redhat.com/software/containers/

Red Hat OpenShift AI 2.25 · Scoped product and version facts
Version (version)	Status (status)	Version scheme (versionType)	Exclusive end (lessThan)	Inclusive end (lessThanOrEqual)	Status changes (at → status)
1788312226	`unaffected`	rpm	*	Unavailable	None listed

Red Hat OpenShift AI 3.3

Vendor: Red Hat
Product: Red Hat OpenShift AI 3.3
Platforms: Unknown
Default status: affected
Package: rhoai/odh-dashboard-rhel9
Package collection: https://catalog.redhat.com/software/containers/

Red Hat OpenShift AI 3.3 · Scoped product and version facts
Version (version)	Status (status)	Version scheme (versionType)	Exclusive end (lessThan)	Inclusive end (lessThanOrEqual)	Status changes (at → status)
1786109683	`unaffected`	rpm	*	Unavailable	None listed

Red Hat OpenShift AI 3.3

Vendor: Red Hat
Product: Red Hat OpenShift AI 3.3
Platforms: Unknown
Default status: affected
Package: rhoai/odh-dashboard-rhel9
Package collection: https://catalog.redhat.com/software/containers/

Red Hat OpenShift AI 3.3 · Scoped product and version facts
Version (version)	Status (status)	Version scheme (versionType)	Exclusive end (lessThan)	Inclusive end (lessThanOrEqual)	Status changes (at → status)
1790128681	`unaffected`	rpm	*	Unavailable	None listed

Red Hat OpenShift AI 3.4

Vendor: Red Hat
Product: Red Hat OpenShift AI 3.4
Platforms: Unknown
Default status: affected
Package: rhoai/odh-dashboard-rhel9
Package collection: https://catalog.redhat.com/software/containers/

Red Hat OpenShift AI 3.4 · Scoped product and version facts
Version (version)	Status (status)	Version scheme (versionType)	Exclusive end (lessThan)	Inclusive end (lessThanOrEqual)	Status changes (at → status)
1786109665	`unaffected`	rpm	*	Unavailable	None listed

Red Hat OpenShift AI 3.4

Vendor: Red Hat
Product: Red Hat OpenShift AI 3.4
Platforms: Unknown
Default status: affected
Package: rhoai/odh-dashboard-rhel9
Package collection: https://catalog.redhat.com/software/containers/

Red Hat OpenShift AI 3.4 · Scoped product and version facts
Version (version)	Status (status)	Version scheme (versionType)	Exclusive end (lessThan)	Inclusive end (lessThanOrEqual)	Status changes (at → status)
1787347991	`unaffected`	rpm	*	Unavailable	None listed