CVE-2026-86332
CVE.org · Published
- Record status
- Published
- Identifier year (not publication year)
- 2026
- Source publication
- Source updated
- Imported by cveboard
- Source snapshot
- cve_2026-10-24_midnight_baseline ·
CNA source text (English)
Odh-dashboard: odh-dashboard: nim credential secret readable by any authenticated user
A flaw was found in odh-dashboard in Red Hat OpenShift AI. The backend-for-frontend route GET /api/nim-serving/:nimResource reads Kubernetes Secrets using the dashboard service account and returns the full Secret object, including .data, without an authorization check. Any authenticated dashboard user can retrieve the cluster NVIDIA NGC API key Secret (apiKeySecret) and the NIM image pull secret (nimPullSecret). Create and delete of the same NIM credential are admin-gated; the read path is not. This is missing authorization (CWE-862) and insufficiently protected credentials (CWE-522). It is distinct from CVE-2026-5483 (service-account token leak in the Kubernetes client response wrapper on the same route) and CVE-2026-16456 (odh-model-controller cross-namespace confused deputy).
Scoped product and version facts
Fix information unknown; no fixed version is derived here. Missing information does not prove that no fix exists.
Exploitation unknown; this catalogue does not assess exploitation.
Red Hat OpenShift AI 2.25
- Vendor
- Red Hat
- Product
- Red Hat OpenShift AI 2.25
- Platforms
- Unknown
- Default status
affected- Package
- rhoai/odh-dashboard-rhel9
- Package collection
- https://catalog.redhat.com/software/containers/
| Version (version) | Status (status) | Version scheme (versionType) | Exclusive end (lessThan) | Inclusive end (lessThanOrEqual) | Status changes (at → status) |
|---|---|---|---|---|---|
| 1791853525 | unaffected | rpm | * | Unavailable | None listed |
Red Hat OpenShift AI 3.5
- Vendor
- Red Hat
- Product
- Red Hat OpenShift AI 3.5
- Platforms
- Unknown
- Default status
affected- Package
- rhoai/odh-dashboard-rhel9
- Package collection
- https://catalog.redhat.com/software/containers/
| Version (version) | Status (status) | Version scheme (versionType) | Exclusive end (lessThan) | Inclusive end (lessThanOrEqual) | Status changes (at → status) |
|---|---|---|---|---|---|
| 1791945160 | unaffected | rpm | * | Unavailable | None listed |
Red Hat OpenShift AI (RHOAI)
- Vendor
- Red Hat
- Product
- Red Hat OpenShift AI (RHOAI)
- Platforms
- Unknown
- Default status
affected- Package
- rhoai/odh-core-bff-rhel9
- Package collection
- https://access.redhat.com/downloads/content/package-browser/
No explicit version tuples; consult this entry's default status.
Red Hat OpenShift AI (RHOAI)
- Vendor
- Red Hat
- Product
- Red Hat OpenShift AI (RHOAI)
- Platforms
- Unknown
- Default status
affected- Package
- rhoai/odh-dashboard-operator-rhel9
- Package collection
- https://access.redhat.com/downloads/content/package-browser/
No explicit version tuples; consult this entry's default status.
Red Hat OpenShift AI (RHOAI)
- Vendor
- Red Hat
- Product
- Red Hat OpenShift AI (RHOAI)
- Platforms
- Unknown
- Default status
affected- Package
- rhoai/odh-dashboard-rhel8
- Package collection
- https://access.redhat.com/downloads/content/package-browser/
No explicit version tuples; consult this entry's default status.
Red Hat OpenShift AI (RHOAI)
- Vendor
- Red Hat
- Product
- Red Hat OpenShift AI (RHOAI)
- Platforms
- Unknown
- Default status
affected- Package
- rhoai/odh-mod-arch-agent-ops-rhel9
- Package collection
- https://access.redhat.com/downloads/content/package-browser/
No explicit version tuples; consult this entry's default status.
Red Hat OpenShift AI (RHOAI)
- Vendor
- Red Hat
- Product
- Red Hat OpenShift AI (RHOAI)
- Platforms
- Unknown
- Default status
affected- Package
- rhoai/odh-mod-arch-automl-rhel9
- Package collection
- https://access.redhat.com/downloads/content/package-browser/
No explicit version tuples; consult this entry's default status.
Red Hat OpenShift AI (RHOAI)
- Vendor
- Red Hat
- Product
- Red Hat OpenShift AI (RHOAI)
- Platforms
- Unknown
- Default status
affected- Package
- rhoai/odh-mod-arch-autorag-rhel9
- Package collection
- https://access.redhat.com/downloads/content/package-browser/
No explicit version tuples; consult this entry's default status.
Red Hat OpenShift AI (RHOAI)
- Vendor
- Red Hat
- Product
- Red Hat OpenShift AI (RHOAI)
- Platforms
- Unknown
- Default status
affected- Package
- rhoai/odh-mod-arch-eval-hub-rhel9
- Package collection
- https://access.redhat.com/downloads/content/package-browser/
No explicit version tuples; consult this entry's default status.
Red Hat OpenShift AI (RHOAI)
- Vendor
- Red Hat
- Product
- Red Hat OpenShift AI (RHOAI)
- Platforms
- Unknown
- Default status
affected- Package
- rhoai/odh-mod-arch-gen-ai-rhel9
- Package collection
- https://access.redhat.com/downloads/content/package-browser/
No explicit version tuples; consult this entry's default status.
Red Hat OpenShift AI (RHOAI)
- Vendor
- Red Hat
- Product
- Red Hat OpenShift AI (RHOAI)
- Platforms
- Unknown
- Default status
affected- Package
- rhoai/odh-mod-arch-maas-rhel9
- Package collection
- https://access.redhat.com/downloads/content/package-browser/
No explicit version tuples; consult this entry's default status.
Red Hat OpenShift AI (RHOAI)
- Vendor
- Red Hat
- Product
- Red Hat OpenShift AI (RHOAI)
- Platforms
- Unknown
- Default status
affected- Package
- rhoai/odh-mod-arch-mlflow-rhel9
- Package collection
- https://access.redhat.com/downloads/content/package-browser/
No explicit version tuples; consult this entry's default status.
Red Hat OpenShift AI (RHOAI)
- Vendor
- Red Hat
- Product
- Red Hat OpenShift AI (RHOAI)
- Platforms
- Unknown
- Default status
affected- Package
- rhoai/odh-mod-arch-model-registry-rhel9
- Package collection
- https://access.redhat.com/downloads/content/package-browser/
No explicit version tuples; consult this entry's default status.