Authorization Flaw in Red Hat OpenShift AI Dashboard Exposes Sensitive Data
CVE-2026-86332

6.5MEDIUM

Key Information:

Vendor

Red Hat
Status
Red Hat Openshift Ai 2.25
Red Hat Openshift Ai 3.5
Red Hat Openshift Ai (rhoai)
Vendor
CVE Published:
7 September 2026

What is CVE-2026-86332?

A vulnerability exists in the backend-for-frontend route of Red Hat OpenShift AI's dashboard, allowing authenticated users to access sensitive Kubernetes Secrets without proper authorization checks. This flaw permits any user with access to the dashboard service account to retrieve the NVIDIA NGC API key and NIM image pull secret, exposing critical credentials. While creation and deletion of the NIM credentials are restricted to administrators, the read functionality lacks similar protections. This issue is categorized under missing authorization (CWE-862) and insufficiently protected credentials (CWE-522), posing a risk to the security of sensitive information.

Affected Version(s)

Red Hat OpenShift AI 2.25 1791853525

Red Hat OpenShift AI 3.5 1791945160

References

https://access.redhat.com/errata/RHSA-2026:86891
vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:87410
vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/security/cve/CVE-2026-86332
vdb-entryx_refsource_REDHAT

CVSS V3.1

Score:
6.5
Severity:
MEDIUM
Confidentiality:
High
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Red Hat would like to thank Dmitry Maranik (Sectum AI) for reporting this issue.
.