Authorization Flaw in Red Hat OpenShift AI Dashboard Exposes Sensitive Data
CVE-2026-86332

6.5MEDIUM

Key Information:

Vendor

Red Hat
Status
Red Hat Openshift Ai (rhoai)
Vendor
CVE Published:
7 September 2026

What is CVE-2026-86332?

A vulnerability exists in the backend-for-frontend route of Red Hat OpenShift AI's dashboard, allowing authenticated users to access sensitive Kubernetes Secrets without proper authorization checks. This flaw permits any user with access to the dashboard service account to retrieve the NVIDIA NGC API key and NIM image pull secret, exposing critical credentials. While creation and deletion of the NIM credentials are restricted to administrators, the read functionality lacks similar protections. This issue is categorized under missing authorization (CWE-862) and insufficiently protected credentials (CWE-522), posing a risk to the security of sensitive information.

References

https://access.redhat.com/security/cve/CVE-2026-86332
vdb-entryx_refsource_REDHAT
https://bugzilla.redhat.com/show_bug.cgi?id=2529287
issue-trackingx_refsource_REDHAT

CVSS V3.1

Score:
6.5
Severity:
MEDIUM
Confidentiality:
High
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Red Hat would like to thank Dmitry Maranik (Sectum AI) for reporting this issue.
.