Description

A flaw was found in the `odh-model-controller`. An authenticated user with permissions to create custom resources can exploit a vulnerability in the `loadSecret` function. This function improperly reads the Secret namespace from user-controlled input without validation. This allows an attacker to read sensitive API keys and cloud credentials from other namespaces, leading to information disclosure.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.5",
  "pubDate": "2026-08-10T21:17:19.867Z",
  "pubdate": "2026-08-10T21:17:19.867Z",
  "executiveSummary": "An information disclosure vulnerability has been identified in the odh-model-controller component. This security flaw stems from improper handling of user-controlled input within the loadSecret function, which fails to validate the Secret namespace correctly. The vulnerability allows an authenticated actor with permissions to create custom resources to read sensitive data across namespace boundaries. Specifically, an attacker can harvest sensitive API keys and cloud credentials originating from namespaces other than their own, resulting in unauthorized data access and severe compromise of cluster-wide secrets. Exploitation of this flaw requires authenticated access with specific permissions to create custom resources within the targeted environment. The risk implication is significant, as compromised cloud credentials and API keys can facilitate lateral movement, privilege escalation, and further exploitation of integrated external services or cloud resources. Mitigating this issue necessitates implementing strict input validation and namespace isolation checks within the affected function to ensure that users cannot arbitrarily reference secrets outside their authorized operational scope.",
  "technicalDetails": "The vulnerability resides within the odh-model-controller, specifically inside the loadSecret function responsible for retrieving Kubernetes Secret objects. The root cause of the flaw is the absence of rigorous input validation and sanitization regarding the Secret namespace parameter derived from user-supplied custom resource definitions. When an authenticated user submits a crafted custom resource, the loadSecret function processes the user-controlled input to fetch the specified Secret. Because the controller fails to validate whether the requested namespace matches the user's authorized operational context or the custom resource's namespace, the API permits cross-namespace secret retrieval.\nThe attack flow begins when an authenticated adversary, possessing baseline permissions to create custom resources, crafts a malicious custom resource payload. This payload targets the loadSecret function by explicitly referencing a sensitive namespace and secret name belonging to another tenant or system component. Upon submission, the odh-model-controller parses the custom resource and executes the vulnerable loadSecret routine, passing the unvalidated namespace parameter directly to the Kubernetes API client. The API client queries and retrieves the sensitive Secret object—such as cloud provider credentials or proprietary API keys—from the foreign namespace. Finally, the controller exposes or logs this sensitive information, or utilizes it in a manner that allows the attacker to harvest the credentials.\nAuthentication and privilege requirements dictate that the attacker must possess valid credentials and sufficient authorization to create custom resources within the cluster. Network exposure is constrained by the access controls of the Kubernetes API server, but the vulnerability itself is triggered internally by the controller logic when processing the malicious custom resource. Post-exploitation impact includes unauthorized information disclosure of critical credentials, enabling adversaries to escalate privileges, access external cloud resources, or pivot to other systems using the harvested API keys and cloud secrets."
}