Privilege Escalation in ODH Dashboard Affects Red Hat
CVE-2026-18950

8.8HIGH

Key Information:

Vendor

Red Hat
Status
Red Hat Openshift Ai (rhoai)
Vendor
CVE Published:
10 August 2026

What is CVE-2026-18950?

A significant security flaw exists in the ODH Dashboard where an authenticated user can exploit improper validation of the roleRef field in RoleBindings. This oversight allows users to designate arbitrary roles, including high-level privileges such as cluster-admin. As a result, this vulnerability poses a risk of privilege escalation, potentially enabling attackers to gain unauthorized elevated access within their namespace, leading to persistent control over the system.

References

https://access.redhat.com/security/cve/CVE-2026-18950
vdb-entryx_refsource_REDHAT
https://bugzilla.redhat.com/show_bug.cgi?id=2511170
issue-trackingx_refsource_REDHAT

CVSS V3.1

Score:
8.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.