CVE-2026-14450 is a critical authentication bypass vulnerability in the MaaS API where the API trusts the X-MaaS-Username and X-MaaS-Group HTTP headers verbatim without first-party authentication. This flaw allows any pod inside the cluster to forge these headers and bypass the Kuadrant AuthPolicy gateway, leading to unauthorized access and privilege escalation. Attackers can mint Kubernetes ServiceAccount tokens in other tenants' namespaces, revoke API keys, and exfiltrate sensitive model access configurations. The vulnerability is scored 9.9 (CVSS v3.1) by Red Hat, reflecting high impact on confidentiality, integrity, and availability. The issue is tracked under CWE-290 (Authentication Bypass by Spoofing).

The vulnerability allows an attacker with access to any pod inside the cluster to bypass authentication controls by forging trusted HTTP headers. This leads to unauthorized access across tenant boundaries, enabling privilege escalation such as minting Kubernetes ServiceAccount tokens in other tenants' namespaces, revoking API keys, and exfiltrating sensitive configuration data. The impact affects confidentiality, integrity, and availability at a high level, potentially compromising multiple tenants within the cluster.

Red Hat has published an advisory indicating that updated images for Red Hat OpenShift AI 3.4.3 are available which address this vulnerability. Users should upgrade to Red Hat OpenShift AI 3.4.3 following the vendor's documented upgrade instructions to fully mitigate this issue. No alternative mitigations or temporary fixes are noted in the advisory. Patch status is confirmed with an official fix available in version 3.4.3.