Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-86332— Odh-dashboard: odh-dashboard: nim credential secret readable by any authenticated user

Quick assessment

Affected
Red Hat Red Hat OpenShift AI 2.25
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Red Hat OpenShift AI是美国Red Hat公司的一款混合云人工智能平台，为数据科学家和开发者提供跨混合云环境构建、开发、训练、部署、服务和监控机器学习（ML）模型及 AI 应用的全生命周期工具。 Red Hat OpenShift AI存在授权问题漏洞，该漏洞源于backend-for-frontend路由GET /api/nim-serving/:nimResource读取Kubernetes Secrets时未进行授权检查，导致任何已认证的dashboard用户均可获取集群NVIDI

CVSS 6.5 · Medium EPSS 0.41% · P35

Affected Version Matrix 13

VendorProduct Version RangeStatus
Red Hat Red Hat OpenShift AI (RHOAI) any affected
any affected
any affected
any affected
any affected
any affected
any affected
any affected
… +3 more rows
Red Hat Red Hat OpenShift AI 2.25 1791853525< * unaffected
Red Hat Red Hat OpenShift AI 3.5 1791945160< * unaffected
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-86332

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
Odh-dashboard: odh-dashboard: nim credential secret readable by any authenticated user
Source: CVE Program / CVE List V5
Vulnerability Description
A flaw was found in odh-dashboard in Red Hat OpenShift AI. The backend-for-frontend route GET /api/nim-serving/:nimResource reads Kubernetes Secrets using the dashboard service account and returns the full Secret object, including .data, without an authorization check. Any authenticated dashboard user can retrieve the cluster NVIDIA NGC API key Secret (apiKeySecret) and the NIM image pull secret (nimPullSecret). Create and delete of the same NIM credential are admin-gated; the read path is not. This is missing authorization (CWE-862) and insufficiently protected credentials (CWE-522). It is distinct from CVE-2026-5483 (service-account token leak in the Kubernetes client response wrapper on the same route) and CVE-2026-16456 (odh-model-controller cross-namespace confused deputy).
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
授权机制缺失
Source: CVE Program / CVE List V5
Vulnerability Title
Red Hat OpenShift AI 授权问题漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Red Hat OpenShift AI是美国Red Hat公司的一款混合云人工智能平台，为数据科学家和开发者提供跨混合云环境构建、开发、训练、部署、服务和监控机器学习（ML）模型及 AI 应用的全生命周期工具。 Red Hat OpenShift AI存在授权问题漏洞，该漏洞源于backend-for-frontend路由GET /api/nim-serving/:nimResource读取Kubernetes Secrets时未进行授权检查，导致任何已认证的dashboard用户均可获取集群NVIDI
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)

Affected Products

Vendor Product Affected Versions CPE Subscribe
Red Hat Red Hat OpenShift AI 2.25 1791853525 ~ * cpe:/a:redhat:openshift_ai:2.25::el9
Red Hat Red Hat OpenShift AI 3.5 1791945160 ~ * cpe:/a:redhat:openshift_ai:3.5::el9
Red Hat Red Hat OpenShift AI (RHOAI) - cpe:/a:redhat:openshift_ai
Red Hat Red Hat OpenShift AI (RHOAI) - cpe:/a:redhat:openshift_ai
Red Hat Red Hat OpenShift AI (RHOAI) - cpe:/a:redhat:openshift_ai
Red Hat Red Hat OpenShift AI (RHOAI) - cpe:/a:redhat:openshift_ai
Red Hat Red Hat OpenShift AI (RHOAI) - cpe:/a:redhat:openshift_ai
Red Hat Red Hat OpenShift AI (RHOAI) - cpe:/a:redhat:openshift_ai
Red Hat Red Hat OpenShift AI (RHOAI) - cpe:/a:redhat:openshift_ai
Red Hat Red Hat OpenShift AI (RHOAI) - cpe:/a:redhat:openshift_ai
Red Hat Red Hat OpenShift AI (RHOAI) - cpe:/a:redhat:openshift_ai
Red Hat Red Hat OpenShift AI (RHOAI) - cpe:/a:redhat:openshift_ai
Red Hat Red Hat OpenShift AI (RHOAI) - cpe:/a:redhat:openshift_ai

II. Public POCs for CVE-2026-86332

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-86332

请登录查看更多情报信息。

Vendor Advisories for CVE-2026-86332 (4)

Same Patch Batch · Red Hat · 2026-09-07 · 10 CVEs total

CVE-2026-18922 9.8 CRITICAL 389-ds-base: 389-ds-base: sasl plain authentication allows privilege escalation to directo
CVE-2026-76578 9.8 CRITICAL Ipa: freeipa: freeipa: unauthenticated ldap client can obtain administrator credentials vi
CVE-2026-86404 8.8 HIGH Artemis-server: artemis-jms-client: artemis-core-client: undertow-core: wildfly-messaging-
CVE-2026-19843 8.4 HIGH 389-ds-base: 389-ds-base: command injection via unescaped ldap dn in cockpit 389 console l
CVE-2026-79678 8.1 HIGH Freeipa: idm: freeipa: idp-add eval() reachable before authorization check allows environm
CVE-2026-18453 7.5 HIGH 389-ds-base: 389-ds-base: pre-authentication null pointer dereference via paged results an
CVE-2026-18355 7.5 HIGH 389-ds-base: 389-ds-base: heap buffer overflow via sasl wrapped-record length lower-bound
CVE-2026-76560 7.5 HIGH 389-ds-base: 389-ds: anonymous ldap client can defeat selfdn aci bind-rule checks via empt
CVE-2026-86469 5.3 MEDIUM Glib2: toctou symlink race in `g_file_create_replace_destination` fallback path

IV. Related Vulnerabilities

Same product: Red Hat OpenShift AI 2.25
Same vendor: Red Hat
Same weakness: CWE-862

V. Comments for CVE-2026-86332

No comments yet

Leave a comment