Database/AI/ML frameworks & serving
OpenShift AI dashboard: unauthorized Secret read exposes the cluster NGC API key and NIM pull secret
Impact
The dashboard's backend-for-frontend reads Kubernetes Secrets with its own service account and returns the whole object including .data, with no authorization check on the read path - create and delete of the same NIM credential are admin-gated, the read is not. Any authenticated dashboard user, including a data scientist with a single project, retrieves the cluster-wide NVIDIA NGC API key and the NIM image pull secret. Those are org-level credentials for pulling entitled NVIDIA inference containers and models, so the blast radius is the whole NGC entitlement, not one namespace. Red Hat states this is distinct from CVE-2026-5483 (service-account token leak on the same route) and CVE-2026-16456.
Who can reach it
Network reach to the OpenShift AI dashboard route plus any valid dashboard login. No admin role, no cluster RBAC on Secrets needed.
What to do
Track the Red Hat advisory for the fixed odh-dashboard build - the record names no fixed version yet. Independently of patching, treat the NGC API key and the NIM pull secret as disclosed and rotate them, because every dashboard user who existed while the route was live could have read them. Rotation is the part that cannot wait for a maintenance window; the dashboard update itself is a rolling deployment with no node impact.
References
Related entries
- Keras: malicious .keras/.h5 weights file reads arbitrary local files via HDF5 ExternalLinksCVE-2026-9335 · Keras (KerasFileEditor and keras.saving.load_weights HDF5 ExternalLink handling)Medium
- vLLM OpenAI-compatible server (chat_template / chat_template_kwargs): NOISY-NEIGHBOUR DENIAL OF SERVICE: one tenantNCVD-2025-018-vllm-openai-compatible-server-ch · vLLM OpenAI-compatible server (chat_template / chat_template_kwargs)Medium
- Ray (GCS Redis credential handling / logging): When the Redis password is passed on the Ray command line it getsCVE-2025-1979 · Ray (GCS Redis credential handling / logging)Medium
- KServe ModelMesh: Group-writable `/etc/passwd` in the container imageCVE-2025-57852 · KServe ModelMeshMedium
- TrustyAI Service Operator: unauthenticated access to AI guardrail and orchestrator APIsCVE-2026-15044 · TrustyAI Service Operator (Red Hat OpenShift AI)Medium
- llama.cpp: oversized seq_id in a saved slot file leaks heap memory past the cells arrayCVE-2026-43630 · llama.cpp server (recurrent memory state slot-restore path)Medium
This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.