ChangeIntel IT change radar

Public mode

No access to your tenant or devices. Every item links to its source. What this means

CVE-2026-16745

Odh-dashboard: odh-dashboard: backend port 8080 trusts x-forwarded-access-token without origin validation

CVSS 3.1 8.8 HIGHCheck source for fixed versionsKEV status unknown

Original advisory

Historical advisory recorded 23 Oct 2026 15:48:27 UTC. Read the latest advisory.

cve-program · CVE-2026-16745

Published

A flaw was found in odh-dashboard, the web console component of Red Hat OpenShift AI (RHOAI). Due to incorrect network binding, a malicious actor within the cluster can bypass authentication and impersonate any user by providing an arbitrary access token. This allows an attacker to gain unauthorized access to the Kubernetes API, potentially leading to arbitrary code execution, privilege escalation, or information disclosure.

Read the publisher's advisory

Affected versions, risk and source history

cve-program · CVE-2026-16745

Published

rhoai/odh-dashboard-rhel9

https://catalog.redhat.com/software/containers/

Publisher's version information

Shown as published. These rules are not interpreted as NuGet package version ranges.

{
                    "vendor": "Red Hat",
                    "product": "Red Hat OpenShift AI 2.25",
                    "collectionURL": "https://catalog.redhat.com/software/containers/",
                    "packageName": "rhoai/odh-dashboard-rhel9",
                    "defaultStatus": "affected",
                    "versions": [
                        {
                            "version": "1785940823",
                            "lessThan": "*",
                            "versionType": "rpm",
                            "status": "unaffected"
                        }
                    ],
                    "cpes": [
                        "cpe:/a:redhat:openshift_ai:2.25::el9"
                    ]
                }

rhoai/odh-dashboard-rhel9

https://catalog.redhat.com/software/containers/

Publisher's version information

Shown as published. These rules are not interpreted as NuGet package version ranges.

{
                    "vendor": "Red Hat",
                    "product": "Red Hat OpenShift AI 2.25",
                    "collectionURL": "https://catalog.redhat.com/software/containers/",
                    "packageName": "rhoai/odh-dashboard-rhel9",
                    "defaultStatus": "affected",
                    "versions": [
                        {
                            "version": "1788312226",
                            "lessThan": "*",
                            "versionType": "rpm",
                            "status": "unaffected"
                        }
                    ],
                    "cpes": [
                        "cpe:/a:redhat:openshift_ai:2.25::el9"
                    ]
                }

rhoai/odh-dashboard-rhel9

https://catalog.redhat.com/software/containers/

Publisher's version information

Shown as published. These rules are not interpreted as NuGet package version ranges.

{
                    "vendor": "Red Hat",
                    "product": "Red Hat OpenShift AI 3.3",
                    "collectionURL": "https://catalog.redhat.com/software/containers/",
                    "packageName": "rhoai/odh-dashboard-rhel9",
                    "defaultStatus": "affected",
                    "versions": [
                        {
                            "version": "1786109683",
                            "lessThan": "*",
                            "versionType": "rpm",
                            "status": "unaffected"
                        }
                    ],
                    "cpes": [
                        "cpe:/a:redhat:openshift_ai:3.3::el9"
                    ]
                }

rhoai/odh-dashboard-rhel9

https://catalog.redhat.com/software/containers/

Publisher's version information

Shown as published. These rules are not interpreted as NuGet package version ranges.

{
                    "vendor": "Red Hat",
                    "product": "Red Hat OpenShift AI 3.3",
                    "collectionURL": "https://catalog.redhat.com/software/containers/",
                    "packageName": "rhoai/odh-dashboard-rhel9",
                    "defaultStatus": "affected",
                    "versions": [
                        {
                            "version": "1790128681",
                            "lessThan": "*",
                            "versionType": "rpm",
                            "status": "unaffected"
                        }
                    ],
                    "cpes": [
                        "cpe:/a:redhat:openshift_ai:3.3::el9"
                    ]
                }

rhoai/odh-dashboard-rhel9

https://catalog.redhat.com/software/containers/

Publisher's version information

Shown as published. These rules are not interpreted as NuGet package version ranges.

{
                    "vendor": "Red Hat",
                    "product": "Red Hat OpenShift AI 3.4",
                    "collectionURL": "https://catalog.redhat.com/software/containers/",
                    "packageName": "rhoai/odh-dashboard-rhel9",
                    "defaultStatus": "affected",
                    "versions": [
                        {
                            "version": "1786109665",
                            "lessThan": "*",
                            "versionType": "rpm",
                            "status": "unaffected"
                        }
                    ],
                    "cpes": [
                        "cpe:/a:redhat:openshift_ai:3.4::el9"
                    ]
                }

rhoai/odh-dashboard-rhel9

https://catalog.redhat.com/software/containers/

Publisher's version information

Shown as published. These rules are not interpreted as NuGet package version ranges.

{
                    "vendor": "Red Hat",
                    "product": "Red Hat OpenShift AI 3.4",
                    "collectionURL": "https://catalog.redhat.com/software/containers/",
                    "packageName": "rhoai/odh-dashboard-rhel9",
                    "defaultStatus": "affected",
                    "versions": [
                        {
                            "version": "1787347991",
                            "lessThan": "*",
                            "versionType": "rpm",
                            "status": "unaffected"
                        }
                    ],
                    "cpes": [
                        "cpe:/a:redhat:openshift_ai:3.4::el9"
                    ]
                }

Original source record · Cite this exact observation · Complete original publisher JSON