CVE-2026-18950High· 8.8▾ TwilightA flaw was found in odh-dashboard. An authenticated user of the dashboard can exploit a vulnerability related to how RoleBindings are created. The system does not properly validate the `roleRef` field, allowing a user to specify an arbit…
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 48.4 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake.
Exploit-prediction probability, daily snapshots since Sep 28.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
Last analysed / modified upstream
0.5%
A flaw was found in odh-dashboard. An authenticated user of the dashboard can exploit a vulnerability related to how RoleBindings are created. The system does not properly validate the roleRef field, allowing a user to specify an arbitrary role, including highly privileged ones like cluster-admin. This can lead to privilege escalation, where an attacker gains unauthorized elevated access within their namespace and potentially persistent control over the system.
Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-18949High· 8.8Odh-dashboard: odh-dashboard: clusterrole grants cluster-wide crud on secrets and rbac management resources
CVE-2026-16745High· 8.8A flaw was found in odh-dashboard, the web console component of Red Hat OpenShift AI (RHOAI)
CVE-2026-110744High· 7.2Multicluster-global-hub-operator-bundle: operator serviceaccount granted unrestricted impersonation of users, groups and serviceaccounts cluster-wide
CVE-2020-25720High· 7.5Samba: check attribute access rights for ldap adds of computers
CVE-2025-12103Medium· 5.0A flaw was found in Red Hat Openshift AI Service
CVE-2025-2843High· 8.8A flaw was found in the Observability Operator