CVE-2026-5483
Kubernetes Token Disclosure via NodeJS Endpoint in odh-dashboard
Publication date: 2026-04-10
Last updated on: 2026-04-21
Assigner: Red Hat, Inc.
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| redhat | openshift_ai | 3.2 |
| redhat | openshift_ai | 3.3 |
| redhat | openshift_ai | From 2.16 (inc) to 2.16.4 (exc) |
| redhat | openshift_ai | From 2.25 (inc) to 2.25.4 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-201 | The code transmits data to another actor, but a portion of the data includes sensitive information that should not be accessible to that actor. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
CVE-2026-5483 is a high-severity security vulnerability found in the odh-dashboard component of Red Hat OpenShift AI (RHOAI).
The flaw allows unauthorized disclosure of Kubernetes Service Account tokens through a NodeJS endpoint in the ODH Dashboard.
Exposure of these tokens could enable attackers to gain unauthorized access to Kubernetes resources, potentially compromising the security of the cluster.
How can this vulnerability impact me? :
This vulnerability can lead to unauthorized access to Kubernetes resources by exposing Service Account tokens.
An attacker exploiting this flaw could compromise the security of your Kubernetes cluster, potentially leading to data breaches, unauthorized operations, or disruption of services.
What immediate steps should I take to mitigate this vulnerability?
To mitigate CVE-2026-5483, you should apply the security update provided in Red Hat Security Advisory RHSA-2026:7397.
This update includes updated container images for Red Hat OpenShift AI version 2.16.4 that resolve the vulnerability in the odh-dashboard component.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
The provided information does not specify how the vulnerability in odh-dashboard of Red Hat OpenShift AI impacts compliance with common standards and regulations such as GDPR or HIPAA.