CVE-2026-18949
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Summary
A flaw was found in odh-dashboard. This vulnerability allows an attacker, who has compromised the dashboard's Service Account (SA) token, to exploit overly broad permissions granted to the SA. This enables the attacker to escalate their privileges to cluster-administrator level, gain access to sensitive data like credentials and keys across the entire cluster, and disrupt multi-tenant isolation.
Affected Software
| Vendor | Product | Version Range | Status |
|---|
Weaknesses
- CWE-250: Execution with Unnecessary Privileges
Workarounds
To mitigate this issue, restrict access to the opendatahub namespace to limit potential compromise of the dashboard pod. Implement egress NetworkPolicy rules to control and restrict outbound network traffic from the dashboard. Additionally, configure audit log alerting to monitor for and detect any unexpected creation of ClusterRoleBindings within the cluster.
References
- https://access.redhat.com/security/cve/CVE-2026-18949
- https://bugzilla.redhat.com/show_bug.cgi?id=2511168
Feedback
Was this page helpful?
Glad to hear it! Please tell us how we can improve.
Sorry to hear that. Please tell us how we can improve.