---
id: CVE-2026-15218
title: >-
  A flaw was found in the maas-api and maas-controller ServiceAccounts within
  Red Hat OpenShift AI
summary: >-
  A flaw was found in the maas-api and maas-controller ServiceAccounts within
  Red Hat OpenShift AI. These ServiceAccounts are granted cluster-wide
  permissions that exceed their operational requirements. An attacker who
  compromises the iden…
severity: high
cvss: 7.9
cvssVector: 'CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:L'
cwe:
  - CWE-266
vendor: Red Hat
product: maas-api
affected:
  - maas-api < *
  - maas-controller < *
  - rhoai/odh-maas-api-rhel9 (all versions)
  - rhoai/odh-maas-controller-rhel9 (all versions)
published: '2026-08-17'
updated: '2026-10-05'
sourceUpdated: '2026-10-05T17:17:14.697'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-15218'
references:
  - url: 'https://access.redhat.com/errata/RHSA-2026:60520'
    label: secalert@redhat.com
  - url: 'https://access.redhat.com/security/cve/CVE-2026-15218'
    label: secalert@redhat.com
  - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2498426'
    label: secalert@redhat.com
  - url: >-
      https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-15218.json
  - url: 'https://www.cve.org/CVERecord?id=CVE-2026-15218'
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-15218'
  - url: 'https://access.redhat.com/errata/RHSA-2026:84734'
tags:
  - nvd
  - cve.org
  - csaf
  - vex
  - red-hat
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: total
  timestamp: '2026-08-17T17:51:07.450608Z'
epss: 0.00706
epssPercentile: 0.53167
ingestedAt: '2026-10-05T17:27:45.029Z'
patched:
  - openshift_ai 3.4
---

## Overview

A flaw was found in the maas-api and maas-controller ServiceAccounts within Red Hat OpenShift AI. These ServiceAccounts are granted cluster-wide permissions that exceed their operational requirements. An attacker who compromises the identity of these ServiceAccounts, either through a remote code execution vulnerability or by creating a malicious pod in the same namespace, could exploit these excessive permissions. This could lead to full cluster administrator privileges through the creation of new ClusterRoleBindings or the disclosure of sensitive information by accessing all secrets across the cluster.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.

## Vendor advisories

- **RHSA-2026:60520** · Red Hat · fixed in: Red Hat OpenShift AI 3.4 · released 2026-08-27 · [advisory](https://access.redhat.com/errata/RHSA-2026:60520)
- **Red Hat VEX** · Moderate · affected: Red Hat OpenShift AI (RHOAI) · no fix planned: Red Hat OpenShift AI (RHOAI) · updated 2026-10-05 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-15218.json)
- **RHSA-2026:84734** · Red Hat · fixed in: Red Hat OpenShift AI 3.4 · released 2026-10-19 · [advisory](https://access.redhat.com/errata/RHSA-2026:84734)