Privilege Escalation in ODH Dashboard Affects Red Hat
CVE-2026-18950

8.8HIGH

Key Information:

Vendor

Red Hat
Status
Red Hat Openshift Ai 2.25
Red Hat Openshift Ai 3.3
Red Hat Openshift Ai 3.4
Red Hat Openshift Ai (rhoai)
Vendor
CVE Published:
10 August 2026

What is CVE-2026-18950?

A significant security flaw exists in the ODH Dashboard where an authenticated user can exploit improper validation of the roleRef field in RoleBindings. This oversight allows users to designate arbitrary roles, including high-level privileges such as cluster-admin. As a result, this vulnerability poses a risk of privilege escalation, potentially enabling attackers to gain unauthorized elevated access within their namespace, leading to persistent control over the system.

Affected Version(s)

Red Hat OpenShift AI 2.25 1785940823

Red Hat OpenShift AI 3.3 1786109683

Red Hat OpenShift AI 3.4 1786109665

References

https://access.redhat.com/errata/RHSA-2026:53261
vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:53262
vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:53263
vendor-advisoryx_refsource_REDHAT

CVSS V3.1

Score:
8.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.