Loading vulnerability…
Kubernetes Service Account Token Disclosure in Red Hat OpenShift AI odh-dashboard
CVE-2026-5483 is an information disclosure vulnerability in the odh-dashboard component of Red Hat OpenShift AI. A NodeJS endpoint exposes Kubernetes Service Account tokens in responses to unauthorized recipients. An attacker who obtains these credentials could authenticate to the Kubernetes API and access resources under the permissions assigned to the affected service account. The exact endpoint and affected version range are not specified.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Disclosure of service account credentials can compromise the confidentiality, integrity, and availability of Kubernetes resources accessible to the affected account. Depending on its RBAC permissions, an attacker could read secrets, create or modify workloads, delete resources, or access resources across namespaces. Cluster-wide administrative access is not established and depends on the stolen token's authorization scope.
If you can’t patch tonight, do this now.
Until patched, restrict access to the dashboard and its NodeJS service to necessary users and trusted network paths. Review and reduce the affected service account's RBAC permissions to limit the consequences of token disclosure. If exposure is suspected, invalidate or rotate affected credentials using the appropriate Kubernetes token lifecycle controls and review Kubernetes audit logs for unauthorized use. These measures limit exposure and impact but do not correct the vulnerable endpoint.
Patch, then assume compromise.
Apply the Red Hat updates addressing CVE-2026-5483 for the installed OpenShift AI release. Consult advisories RHSA-2026:7397 and RHSA-2026:7403 for applicable fixed packages and upgrade instructions. Exact affected and fixed versions are not specified in the available information.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
8 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.