CVE Feed

    Dashboard / CVE / CVE-2026-16456

    CVE-2026-16456

    A flaw was found in the `odh-model-controller`. An authenticated user with permissions to create custom resources can exploit a vulnerability in the `loadSecret` function. This function improperly reads the Secret namespace from user-controlled input without validation. This allows an attacker to read sensitive API keys and cloud credentials from other namespaces, leading to information disclosure.

    Published:Aug 10, 2026
    Last Modified:Aug 11, 2026
    EPS:Aug 10, 2026
    EPSS Score:0.00299
    CVSS Score:6.5

    Affected Products

    Vendor
    Red Hat
    Product
    Red Hat Openshift Ai (rhoai)
    Vendor
    Redhat
    Product
    Openshift Ai

    Exploits

    No exploit reference

    Common Attack Pattern Enumeration and Classification (CAPEC)

    CAPEC-219 XML Routing Detour Attacks
    CAPEC-465 Transparent Proxy Abuse

    Related CVEs

    CVE-2026-86332 (CVSS 6.5) — A flaw was found in odh-dashboard in Red Hat OpenShift AI. The backend-for-frontend route GET /api/nim-serving…
    CVE-2026-84185 (CVSS 5.9) — A flaw was found in the jwcrypto library, which is used for implementing Javascript Object Signing and Encrypt…
    CVE-2026-18393 (CVSS 5.4) — A flaw was found in FFmpeg. The tdsc_load_cursor() function writes beyond the bounds of a heap-allocated buffe…
    CVE-2026-80179 (CVSS 5.9) — A flaw was found in jwcrypto. A remote attacker can send a specially crafted JSON Web Encryption (JWE) token c…
    CVE-2026-15218 (CVSS 7.9) — A flaw was found in the maas-api and maas-controller ServiceAccounts within Red Hat OpenShift AI. These Servic…
    CVE-2026-18947 (CVSS 8.5) — A flaw was found in Feast. An authorization bypass vulnerability exists in the /materialize and /materialize-i…
    CVE-2026-18982 (CVSS 8.8) — A flaw was found in the RHOAI training-operator. This vulnerability allows a user with standard edit or admin …
    CVE-2026-18950 (CVSS 8.8) — A flaw was found in odh-dashboard. An authenticated user of the dashboard can exploit a vulnerability related …
    CVE-2026-18949 (CVSS 8.8) — A flaw was found in odh-dashboard. This vulnerability allows an attacker, who has compromised the dashboard's …
    CVE-2026-18948 (CVSS 9.9) — A flaw was found in Feast. The system improperly deserializes user-defined functions (UDFs) stored in its regi…

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High