CVE Feed

    Dashboard / CVE / CVE-2026-14450

    CVE-2026-14450

    A flaw was found in the MaaS API. This vulnerability allows any pod within the cluster to bypass the Kuadrant AuthPolicy gateway by forging HTTP headers, specifically `X-MaaS-Username` and `X-MaaS-Group`, which are trusted verbatim. This lack of first-party authentication enables an attacker to gain unauthorized access and escalate privileges. The concrete consequences include the ability to mint Kubernetes ServiceAccount tokens in other tenants' namespaces, revoke API keys, and exfiltrate sensitive model access configuration.

    Published:Aug 10, 2026
    Last Modified:Aug 27, 2026
    EPS:Aug 10, 2026
    EPSS Score:0.00452
    CVSS Score:9.9

    Affected Products

    Vendor
    Red Hat
    Product
    Red Hat Openshift Ai (rhoai)
    Vendor
    Redhat
    Product
    Openshift Ai

    Exploits

    No exploit reference

    Related CVEs

    CVE-2026-86332 (CVSS 6.5) — A flaw was found in odh-dashboard in Red Hat OpenShift AI. The backend-for-frontend route GET /api/nim-serving…
    CVE-2026-84185 (CVSS 5.9) — A flaw was found in the jwcrypto library, which is used for implementing Javascript Object Signing and Encrypt…
    CVE-2026-18393 (CVSS 5.4) — A flaw was found in FFmpeg. The tdsc_load_cursor() function writes beyond the bounds of a heap-allocated buffe…
    CVE-2026-80179 (CVSS 5.9) — A flaw was found in jwcrypto. A remote attacker can send a specially crafted JSON Web Encryption (JWE) token c…
    CVE-2026-15218 (CVSS 7.9) — A flaw was found in the maas-api and maas-controller ServiceAccounts within Red Hat OpenShift AI. These Servic…
    CVE-2026-18947 (CVSS 8.5) — A flaw was found in Feast. An authorization bypass vulnerability exists in the /materialize and /materialize-i…
    CVE-2026-18982 (CVSS 8.8) — A flaw was found in the RHOAI training-operator. This vulnerability allows a user with standard edit or admin …
    CVE-2026-18950 (CVSS 8.8) — A flaw was found in odh-dashboard. An authenticated user of the dashboard can exploit a vulnerability related …
    CVE-2026-18949 (CVSS 8.8) — A flaw was found in odh-dashboard. This vulnerability allows an attacker, who has compromised the dashboard's …
    CVE-2026-18948 (CVSS 9.9) — A flaw was found in Feast. The system improperly deserializes user-defined functions (UDFs) stored in its regi…

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High