Description

A flaw was found in odh-dashboard in Red Hat OpenShift AI. The backend-for-frontend route GET /api/nim-serving/:nimResource reads Kubernetes Secrets using the dashboard service account and returns the full Secret object, including .data, without an authorization check. Any authenticated dashboard user can retrieve the cluster NVIDIA NGC API key Secret (apiKeySecret) and the NIM image pull secret (nimPullSecret). Create and delete of the same NIM credential are admin-gated; the read path is not. This is missing authorization (CWE-862) and insufficiently protected credentials (CWE-522). It is distinct from CVE-2026-5483 (service-account token leak in the Kubernetes client response wrapper on the same route) and CVE-2026-16456 (odh-model-controller cross-namespace confused deputy).

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.5",
  "pubDate": "2026-09-07T09:17:17.807Z",
  "pubdate": "2026-09-07T09:17:17.807Z",
  "executiveSummary": "A critical authorization flaw exists in the odh-dashboard component of Red Hat OpenShift AI. The vulnerability, classified as CWE-862 (Missing Authorization) and CWE-522 (Insufficiently Protected Credentials), resides in the backend-for-frontend route responsible for managing NIM resources.\nThe flaw allows any authenticated user of the dashboard to perform unauthorized read operations on sensitive Kubernetes Secrets. Specifically, the GET /api/nim-serving/:nimResource endpoint retrieves and returns full Secret objects, including sensitive fields within .data, without validating the requester's permissions.\nImpacted credentials include the NVIDIA NGC API key (apiKeySecret) and the NIM image pull secret (nimPullSecret). By exploiting this lack of access control, an authenticated attacker can exfiltrate high-privilege credentials used for container registry authentication and external service integration. This vulnerability poses a severe risk to cluster security, potentially allowing unauthorized image pulls or the misuse of NVIDIA NGC assets. The issue is distinct from CVE-2026-5483 and CVE-2026-16456. Exploitation requires no special privileges beyond a standard authenticated dashboard account, making this a significant privilege escalation vector.",
  "technicalDetails": "The vulnerability originates in the backend-for-frontend (BFF) logic of the odh-dashboard service. The route GET /api/nim-serving/:nimResource is improperly implemented, failing to enforce role-based access control (RBAC) or attribute-based access control (ABAC) before querying the Kubernetes API server.\nThe system utilizes the dashboard service account to interact with the Kubernetes API. Because the backend service account possesses read permissions for the secrets in question, the dashboard backend successfully retrieves these resources. However, the application layer fails to verify if the user initiating the HTTP request possesses the necessary authorization to view the metadata or the data content of these specific Kubernetes Secret resources.\nThe attack flow proceeds as follows: 1. An attacker authenticates to the odh-dashboard as a standard user. 2. The attacker triggers a GET request to /api/nim-serving/:nimResource. 3. The backend receives this request and invokes an internal function to fetch the associated Kubernetes Secret from the cluster. 4. The backend service account queries the K8s API and receives the full Secret object, including the sensitive .data block containing base64-encoded credentials. 5. The backend erroneously serializes the entire Secret object, including sensitive keys, into the JSON response body and returns it to the client.\nBy inspecting the HTTP response, an attacker can extract the NVIDIA NGC API key and the NIM image pull credentials. This information is returned in plaintext (post-decoding of the base64 content), granting the attacker persistent access to private container registries or protected NVIDIA services. This is particularly egregious as the system correctly implements admin-gating for 'create' and 'delete' operations on these credentials but ignores authorization entirely for the 'read' operation.\nThe vulnerability is limited to authenticated users; however, in many enterprise deployments of Red Hat OpenShift AI, standard users often possess login capabilities. Once the secrets are compromised, the attacker can leverage the NVIDIA NGC API key to impersonate the service or pull images for analysis or unauthorized deployment, leading to a breakdown of the principle of least privilege within the OpenShift cluster environment."
}