Excessive Privileges in Red Hat OpenShift AI Service Accounts
CVE-2026-15218

7.9HIGH

Key Information:

Vendor

Red Hat
Status
Red Hat Openshift Ai (rhoai)
Vendor
CVE Published:
17 August 2026

What is CVE-2026-15218?

A vulnerability exists in the maas-api and maas-controller ServiceAccounts within Red Hat OpenShift AI, where these accounts possess cluster-wide permissions that are greater than necessary. If an attacker compromises these ServiceAccounts—through a remote code execution flaw or by deploying a malicious pod within the same namespace—they can exploit these excessive permissions. This exploitation could enable the attacker to gain full cluster administrator privileges by creating new ClusterRoleBindings or accessing sensitive information through the retrieval of all secrets within the cluster.

References

https://access.redhat.com/security/cve/CVE-2026-15218
vdb-entryx_refsource_REDHAT
https://bugzilla.redhat.com/show_bug.cgi?id=2498426
issue-trackingx_refsource_REDHAT

CVSS V3.1

Score:
7.9
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
High
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.