A flaw was found in odh-dashboard in Red Hat OpenShift AI. (CVE-2026-86332)

CVE-2026-86332 describes a missing authorization vulnerability (CWE-862) in the odh-dashboard backend-for-frontend route GET /api/nim-serving/:nimResource in Red Hat OpenShift AI. The route reads Kubernetes Secrets using the dashboard service account and returns the full Secret object, including the .data field, without verifying the requesting user's authorization. Consequently, any authenticated user of the dashboard can retrieve sensitive cluster secrets such as the NVIDIA NGC API key (apiKeySecret) and the NIM image pull secret (nimPullSecret). Although creation and deletion of these credentials are restricted to admins, the read path lacks such protection, leading to exposure of sensitive credentials (CWE-522). This vulnerability is distinct from other related CVEs affecting the same component.

The vulnerability allows any authenticated user of the odh-dashboard to access sensitive Kubernetes Secrets without authorization checks. This exposure includes critical credentials like the NVIDIA NGC API key and image pull secrets, potentially enabling unauthorized access to protected resources or services that rely on these secrets. The flaw does not affect unauthenticated users but compromises confidentiality for authenticated users with dashboard access.

Red Hat has released an updated version of Red Hat OpenShift AI (RHOAI 3.5.2) that addresses this and other security issues. Users should upgrade to RHOAI 3.5.2 following the official Red Hat documentation to fully apply the errata update. No alternative mitigations are specified, so applying the official update is the recommended remediation.