CVE-2026-18949 is a vulnerability in the odh-dashboard component that arises from overly broad permissions granted to the dashboard's Service Account token. An attacker who compromises this token can escalate privileges to cluster-administrator level, gain access to sensitive data such as credentials and keys across the entire cluster, and disrupt multi-tenant isolation. The vulnerability has a CVSS v3.1 score of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), indicating network attack vector, low attack complexity, required low privileges, no user interaction, unchanged scope, and high impact on confidentiality, integrity, and availability. Red Hat advisories mention this CVE among others affecting Red Hat OpenShift AI but currently list no fixes for it, indicating patch status is not yet confirmed.

An attacker with access to the odh-dashboard Service Account token can escalate privileges to cluster-administrator level, compromising the entire cluster's security. This includes unauthorized access to sensitive credentials and keys, potentially leading to data breaches and disruption of multi-tenant isolation, which can affect multiple tenants sharing the cluster environment. The impact is high on confidentiality, integrity, and availability of the cluster resources.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Red Hat advisories acknowledge the vulnerability but do not currently provide a fix. Users should monitor Red Hat OpenShift AI documentation and advisories for updates on patches or mitigations. Until a fix is available, restrict access to the dashboard's Service Account token and limit permissions where possible to reduce risk.