CVE-2024-7557High· 8.8▾ TwilightA vulnerability was found in OpenShift AI that allows for authentication bypass and privilege escalation across models within the same namespace. When deploying AI models, the UI provides the option to protect models with authentication.…
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 48.4 · likelihood 0.2 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake. The CVSS score shown above comes from the assigning CNA record, not NVD.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via CVEORG
Last analysed / modified upstream
1.0%
A vulnerability was found in OpenShift AI that allows for authentication bypass and privilege escalation across models within the same namespace. When deploying AI models, the UI provides the option to protect models with authentication. However, credentials from one model can be used to access other models and APIs within the same namespace. The exposed ServiceAccount tokens, visible in the UI, can be utilized with oc --token={token} to exploit the elevated view privileges associated with the ServiceAccount, leading to unauthorized access to additional resources.
odh-dashboard 2.8.*odh-dashboard 2.11rhoai/odh-codeflare-operator-rhel8 (all versions)rhoai/odh-dashboard-rhel8 (all versions)rhoai/odh-data-science-pipelines-argo-argoexec-rhel8 (all versions)rhoai/odh-data-science-pipelines-argo-workflowcontroller-rhel8 (all versions)rhoai/odh-data-science-pipelines-operator-controller-rhel8 (all versions)rhoai/odh-kf-notebook-controller-rhel8 (all versions)rhoai/odh-kuberay-operator-controller-rhel8 (all versions)rhoai/odh-kueue-controller-rhel8 (all versions)rhoai/odh-mlmd-grpc-server-rhel8 (all versions)rhoai/odh-ml-pipelines-api-server-rhel8 (all versions)rhoai/odh-ml-pipelines-api-server-v2-rhel8 (all versions)rhoai/odh-ml-pipelines-artifact-manager-rhel8 (all versions)rhoai/odh-ml-pipelines-cache-rhel8 (all versions)rhoai/odh-ml-pipelines-driver-rhel8 (all versions)rhoai/odh-ml-pipelines-launcher-rhel8 (all versions)rhoai/odh-ml-pipelines-persistenceagent-rhel8 (all versions)rhoai/odh-ml-pipelines-persistenceagent-v2-rhel8 (all versions)rhoai/odh-ml-pipelines-scheduledworkflow-rhel8 (all versions)rhoai/odh-ml-pipelines-scheduledworkflow-v2-rhel8 (all versions)rhoai/odh-mm-rest-proxy-rhel8 (all versions)rhoai/odh-model-controller-rhel8 (all versions)rhoai/odh-modelmesh-rhel8 (all versions)rhoai/odh-modelmesh-runtime-adapter-rhel8 (all versions)rhoai/odh-modelmesh-serving-controller-rhel8 (all versions)rhoai/odh-model-registry-operator-rhel8 (all versions)rhoai/odh-model-registry-rhel8 (all versions)rhoai/odh-notebook-controller-rhel8 (all versions)rhoai/odh-operator-bundle (all versions)rhoai/odh-rhel8-operator (all versions)rhoai/odh-training-operator-rhel8 (all versions)rhoai/odh-trustyai-service-operator-rhel8 (all versions)rhoai/odh-trustyai-service-rhel8 (all versions)rhods/odh-dashboard-rhel8 (all versions)rhods/odh-model-controller-rhel8 (all versions)Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-88837Medium· 6.5BusyBox httpd treats yescrypt ($y$) password hashes as plaintext during Basic Authentication, inverting the authentication check.
CVE-2022-46146High· 7.5exporter-toolkit: authentication bypass via cache poisoning (CVE-2022-46146)
CVE-2026-12795High· 7.3litellm: BerriAI litellm: Missing authentication in SSO Debug Flow allows remote access. (CVE-2026-12795)
CVE-2026-114690Medium· 6.2Gcc: confirmed out-of-bounds read/write in libstdc++ parallel `std
CVE-2026-114691Medium· 5.9Gcc: integer wrap in `std
CVE-2026-110133Medium· 5.8Ghostscript: heap buffer overflow in ghostscript truetype outliner due to npointstotal integer underflow during retry rollback