← Vulnerability feed

Vulnerability record · CVE-2026-5483 · published 10 April 2026

CVE-2026-5483: Redhat openshift ai vulnerability

Redhat · Openshift Ai

A flaw was found in odh-dashboard in Red Hat Openshift AI. This vulnerability in the `odh-dashboard` component of Red Hat OpenShift AI (RHOAI) allows for the disclosure of Kubernetes Service Account tokens through a NodeJS endpoint. This could enable an attacker to gain unauthorized access to Kubernetes resources.

9.9 CVSS 3.1 Critical EPSS 0.65% · top 50.8% CWE-201 · CWE-201
9.9CVSS 3.1 base score
0.65%EPSS exploitation probability, 30 days
NoNot in CISA KEV
1Affected product versions listed by NVD
13References
15 Jul 2026Last modified by NVD

Description

A flaw was found in odh-dashboard in Red Hat Openshift AI. This vulnerability in the `odh-dashboard` component of Red Hat OpenShift AI (RHOAI) allows for the disclosure of Kubernetes Service Account tokens through a NodeJS endpoint. This could enable an attacker to gain unauthorized access to Kubernetes resources.

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
https://access.redhat.com/errata/RHSA-2026:7397 Vendor Advisory
https://access.redhat.com/errata/RHSA-2026:7398 Vendor Advisory
https://access.redhat.com/errata/RHSA-2026:7403 Vendor Advisory
https://access.redhat.com/errata/RHSA-2026:7404 Vendor Advisory
https://access.redhat.com/security/cve/CVE-2026-5483 Vendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2454764 Issue TrackingVendor Advisory
https://access.redhat.com/errata/RHSA-2026:7397 Vendor Advisory
https://access.redhat.com/errata/RHSA-2026:7398 Vendor Advisory
https://access.redhat.com/errata/RHSA-2026:7403 Vendor Advisory
https://access.redhat.com/errata/RHSA-2026:7404 Vendor Advisory
https://access.redhat.com/security/cve/CVE-2026-5483 Vendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2454764 Issue TrackingVendor Advisory
https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-5483.json

Track CVE-2026-5483 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

8.7CVE-2026-42271LiteLLM MCP test endpoints allow authenticated OS command injectionLiteLLM versions 1.74.2 through before 1.83.7 expose two MCP preview endpoints (POST /mcp-rest/test/connection and POST /mcp-rest/test/tools/list) th…KEVEPSS 13%analysed6.5CVE-2026-48710Starlette Host header validation flaw enables request.url path mismatchStarlette before 1.0.1 did not validate the HTTP Host header before using it to rebuild request.url, so a malformed Host value could make request.url…KEVEPSS 7.1%analysed8.8CVE-2024-7557Redhat openshift ai vulnerabilityA vulnerability was found in OpenShift AI that allows for authentication bypass and privilege escalation across models within the same namespace. Whe…EPSS 0.93%8.7CVE-2023-54365Traefik uncontrolled resource consumption vulnerabilityTraefik before 2.10.5 and 3.0.0-beta4 is affected by a denial-of-service vulnerability in HTTP/2 request handling inherited from the Go standard libr…EPSS 0.77%8.1CVE-2025-12805Redhat openshift ai vulnerabilityA flaw was found in Red Hat OpenShift AI (RHOAI) llama-stack-operator. This vulnerability allows unauthorized access to Llama Stack services deployed…EPSS 0.38%7.8CVE-2026-1462Keras deserialization of untrusted data vulnerabilityA vulnerability in the `TFSMLayer` class of the `keras` package, version 3.13.0, allows attacker-controlled TensorFlow SavedModels to be loaded durin…EPSS 0.40%7.5CVE-2026-46625Js-cookie javascript cookie prototype pollution vulnerabilityJavaScript Cookie is a JavaScript API for handling cookies, client-side. Prior to version 3.0.7, js-cookie's internal assign() helper copies properti…EPSS 0.99%6.5CVE-2026-15154Redhat openshift ai inefficient regular expression (redos) vulnerabilityA flaw was found in `guardrails-detectors`, a component of Red Hat OpenShift AI. This vulnerability, known as Regular Expression Denial of Service (R…EPSS 0.46%

Source: NIST National Vulnerability Database (record CVE-2026-5483), CISA KEV, FIRST EPSS (scores of 2026-09-27). This page is refreshed as NVD updates the record.