CVE-2026-86332 in odh-dashboard
Summary
by MITRE • 09/07/2026
A flaw was found in odh-dashboard in Red Hat OpenShift AI. The backend-for-frontend route GET /api/nim-serving/:nimResource reads Kubernetes Secrets using the dashboard service account and returns the full Secret object, including .data, without an authorization check. Any authenticated dashboard user can retrieve the cluster NVIDIA NGC API key Secret (apiKeySecret) and the NIM image pull secret (nimPullSecret). Create and delete of the same NIM credential are admin-gated; the read path is not. This is missing authorization (CWE-862) and insufficiently protected credentials (CWE-522). It is distinct from CVE-2026-5483 (service-account token leak in the Kubernetes client response wrapper on the same route) and CVE-2026-16456 (odh-model-controller cross-namespace confused deputy).
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 09/07/2026
The vulnerability identified within Red Hat OpenShift AI, specifically affecting the odh-dashboard component, represents a critical failure in access control mechanisms for sensitive credential data. The core technical flaw resides in the backend-for-frontend route GET /api/nim-serving/:nimResource. This endpoint is designed to facilitate interactions with NVIDIA NIM (NVIDIA Inference Microservices) resources within the OpenShift AI environment. However, the implementation fails to enforce proper authorization checks when retrieving Kubernetes Secrets associated with these resources. Instead of validating whether the requesting user has specific permissions to view secret data, the dashboard service account directly queries the Kubernetes API server and returns the complete Secret object to the authenticated frontend client. This includes sensitive fields such as .data, which typically contain base64-encoded credentials like API keys or image pull tokens.
This architectural oversight results in a severe breach of confidentiality for any user who can authenticate to the OpenShift AI dashboard. Specifically, users are able to retrieve two critical secrets: the NVIDIA NGC (NVIDIA GPU Cloud) API key stored in apiKeySecret and the NIM image pull secret stored in nimPullSecret. The distinction between read operations and write operations is particularly problematic here. While the creation and deletion of these NIM credentials are correctly gated by administrative privileges, the read path remains wide open to all authenticated users. This asymmetry creates a significant security gap where lower-privileged users can escalate their effective privilege level simply by reading sensitive material that should be restricted to administrators or specific service accounts with explicit need-to-know access.
From a classification perspective, this vulnerability is primarily categorized under CWE-862, which denotes Missing Authorization. The system fails to ensure that the user initiating the request has the necessary permissions for the action being performed on the resource. Furthermore, it aligns closely with CWE-522, Insufficiently Protected Credentials, as the sensitive authentication tokens are exposed in plaintext within the API response without adequate protection or access restrictions. In terms of adversary behavior mapping to MITRE ATT&CK, this flaw facilitates Credential Access techniques such as T1098 (Account Manipulation) if an attacker were to use these keys for further account creation, but more directly it enables T1528 (Steal Application Access Token) or general data exfiltration of sensitive configuration details. The exposure allows attackers to potentially impersonate services using the NGC API key or pull proprietary container images from private registries if they possess the NIM image pull secret.
The operational impact of this vulnerability is substantial, as it compromises the integrity and confidentiality of the AI inference infrastructure. An attacker with a standard dashboard account could extract the NVIDIA NGC API key to make unauthorized requests against NVIDIA services, potentially incurring financial costs or abusing service quotas. Alternatively, access to the NIM image pull secret allows for the downloading of container images that may contain proprietary algorithms or sensitive model weights intended only for authorized deployments within the cluster. This undermines the multi-tenant security model of OpenShift AI, where isolation between different user groups is paramount. It also exposes internal infrastructure details that could aid in further reconnaissance and lateral movement within the Kubernetes environment.
Mitigation strategies must focus on implementing strict authorization checks at the API level before any secret data is retrieved from the Kubernetes API server. The backend service should verify that the authenticated user possesses specific RBAC permissions, such as cluster-admin or a custom role explicitly granting access to view NIM-related secrets, prior to executing the GET request for /api/nim-serving/:nimResource. If read access must be granted to non-admin users, the implementation should sanitize the response to exclude sensitive fields like .data, providing only metadata necessary for operational purposes without exposing actual credentials. Additionally, immediate rotation of any exposed NVIDIA NGC API keys and NIM image pull secrets is critical if this vulnerability has been exploited in a production environment. Long-term remediation involves auditing all backend-for-frontend routes to ensure consistent application of the principle of least privilege across both read and write operations for sensitive resources.