Database/AI/ML frameworks & serving
Red Hat OpenShift AI: odh-dashboard endpoint discloses Kubernetes ServiceAccount tokens
Impact
A NodeJS endpoint in odh-dashboard returns Kubernetes ServiceAccount tokens to the caller. With a dashboard token in hand an attacker talks to the cluster API directly with that ServiceAccount's rights, outside the dashboard's own authorization checks. On an RHOAI cluster that is where the GPU workloads live: notebooks, model-serving runtimes, pipeline runs and the data connections behind them, usually spanning multiple teams in one cluster. Red Hat scores it 9.9 with a scope change, which matches a token that reaches beyond the namespace the caller was supposed to be confined to.
Who can reach it
Network access to the odh-dashboard route with low-privilege credentials (CVSS PR:L) - any user who can log into the RHOAI dashboard, including a data scientist with a single notebook namespace.
What to do
Apply the RHSA errata for your RHOAI stream (2.16, 2.25, 3.2, 3.3 are listed) and roll out the odh-dashboard deployment. Rotate any ServiceAccount tokens that may already have been exposed, since patching does not invalidate a token an attacker already read. Pod rollout only - no node drain or reboot.
References
Related entries
- NVIDIA OpenShell: incomplete input denylist in the sandbox provisioning API allows code executionCVE-2026-65083 · NVIDIA OpenShell (sandbox provisioning API)Critical
- NVIDIA OpenShell: sandbox escape lets confined code run outside the sandboxCVE-2026-65093 · NVIDIA OpenShell (agent sandbox confinement)Critical
- MCPHub: any authenticated user can register an MCP server and run arbitrary commands as the service userCVE-2026-79748 · MCPHub (POST /api/servers, PUT /api/servers/:name)Critical
- GitLab AI Gateway: crafted Duo flow config escapes the prompt template sandbox into command executionCVE-2026-90970 · GitLab AI Gateway (Duo Agent Platform flow configuration)Critical
- Yuxi: sandbox tenants reach other tenants' sandboxes, shared services and the unauthenticated provisionerCVE-2026-97693 · Yuxi LLM knowledge-base platform (Docker sandbox isolation and sandbox provisioner)Critical
- scikit-learn / joblib: `joblib.load()` executes commands from an untrusted file via `__reduce__`CVE-2020-13092 · scikit-learn / joblibCritical
This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.