CVE-2026-86332
Received Received - Intake

Stored Credential Exposure in Red Hat OpenShift AI odh-dashboard

Publication date: 2026-09-07

Last updated on: 2026-09-07

Assigner: redhat-SADP

Description
A flaw was found in odh-dashboard in Red Hat OpenShift AI. The backend-for-frontend route GET /api/nim-serving/:nimResource reads Kubernetes Secrets using the dashboard service account and returns the full Secret object, including .data, without an authorization check. Any authenticated dashboard user can retrieve the cluster NVIDIA NGC API key Secret (apiKeySecret) and the NIM image pull secret (nimPullSecret). Create and delete of the same NIM credential are admin-gated; the read path is not. This is missing authorization (CWE-862) and insufficiently protected credentials (CWE-522). It is distinct from CVE-2026-5483 (service-account token leak in the Kubernetes client response wrapper on the same route) and CVE-2026-16456 (odh-model-controller cross-namespace confused deputy).

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-07
Last Modified
2026-09-07
Generated
2026-09-07
AI Q&A
2026-09-07
EPSS Evaluated
N/A
NVD
CVE-2026-86332
EUVD
EUVD-2026-72304

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
red_hat odh-dashboard *
red_hat odh_dashboard *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-862 The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is in the odh-dashboard component of Red Hat OpenShift AI. The flaw allows any authenticated dashboard user to read sensitive Kubernetes Secrets, specifically the NVIDIA NGC API key Secret and the NIM image pull secret, through the GET /api/nim-serving/:nimResource route. The issue is missing authorization checks, allowing unauthorized access to credentials.

Detection Guidance

Check for unauthorized access to Kubernetes Secrets via the vulnerable route GET /api/nim-serving/:nimResource in the odh-dashboard. Review logs for suspicious GET requests to this endpoint by non-admin users. Verify if any non-admin dashboard users have accessed apiKeySecret or nimPullSecret Secrets.

Impact Analysis

An attacker with authenticated dashboard access could steal shared cluster NVIDIA NGC/NIM credentials. This could lead to unauthorized access to NVIDIA services, potential data breaches, or misuse of the compromised credentials for further attacks. Exploitation requires a logged-in dashboard session and a configured NIM Account.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating confidentiality requirements in GDPR and HIPAA. Exposure of credentials may result in non-compliance with data protection regulations, potentially leading to legal penalties or reputational damage.

Mitigation Strategies

Disable or remove the NVIDIA NIM integration in OpenShift AI. Restrict dashboard access to trusted administrators only. Apply patches or updates to the odh-dashboard image once available. Rotate exposed NVIDIA NGC API keys and NIM image pull secrets if they may have been compromised.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-86332. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart