CVE-2026-16745 | A flaw was found in odh-dashboard, the web console component… | CVSS 8.8 HIGH

Description

A flaw was found in odh-dashboard, the web console component of Red Hat OpenShift AI (RHOAI). Due to incorrect network binding, a malicious actor within the cluster can bypass authentication and impersonate any user by providing an arbitrary access token. This allows an attacker to gain unauthorized access to the Kubernetes API, potentially leading to arbitrary code execution, privilege escalation, or information disclosure.

Metadata

CVE ID: CVE-2026-16745
State: PUBLISHED
Assigner: redhat
Reserved: 2026-07-23 10:24 UTC
Published: 2026-07-23 10:41 UTC
Last updated: 2026-07-23 13:53 UTC
Primary CWE: CWE-346
Origin Validation Error
Vendor / Product: Red Hat / Red Hat OpenShift AI (RHOAI)
Sources: cve.org · NVD

Severity & Metrics

8.8 HIGH CVSS 3.1

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

SSVC — CISA Coordinator

Exploitation: none
Automatable: no
Tech. Impact: total

Affected products (1)

Vendor	Product	Platform	Versions
Red Hat	Red Hat OpenShift AI (RHOAI)	—	—

Weakness (CWE)

CWE	Source	Description
CWE-346	cna	Origin Validation Error

CVSS scores (1)

Score	Severity	Version	Source	Vector
8.8	HIGH	3.1	cna	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

References (2)