CyberRota Analysis
AI-GeneratedA vulnerability exists in the odh-dashboard of Red Hat OpenShift AI, where the backend-for-frontend route allows any authenticated user to access Kubernetes Secrets, including sensitive API keys, without proper authorization checks. This flaw can lead to unauthorized disclosure of critical credentials, posing a risk to the integrity and security of the Kubernetes environment. Organizations utilizing Kubernetes with OpenShift AI should prioritize addressing this issue to mitigate potential data breaches.
Original NVD Description
A flaw was found in odh-dashboard in Red Hat OpenShift AI. The backend-for-frontend route GET /api/nim-serving/:nimResource reads Kubernetes Secrets using the dashboard service account and returns the full Secret object, including .data, without an authorization check. Any authenticated dashboard user can retrieve the cluster NVIDIA NGC API key Secret (apiKeySecret) and the NIM image pull secret (nimPullSecret). Create and delete of the same NIM credential are admin-gated; the read path is not. This is missing authorization (CWE-862) and insufficiently protected credentials (CWE-522). It is distinct from CVE-2026-5483 (service-account token leak in the Kubernetes client response wrapper on the same route) and CVE-2026-16456 (odh-model-controller cross-namespace confused deputy).