CVE-2026-14450: Authentication Bypass by Spoofing in Red Hat Red Hat OpenShift AI (RHOAI)
CVE-2026-14450 is a critical authentication bypass vulnerability in the MaaS API of Red Hat OpenShift AI (RHOAI). It allows any pod within the cluster to forge HTTP headers (X-MaaS-Username and X-MaaS-Group) trusted by the Kuadrant AuthPolicy gateway, bypassing authentication. This enables unauthorized access and privilege escalation, including minting Kubernetes ServiceAccount tokens in other tenants' namespaces, revoking API keys, and exfiltrating sensitive configuration data.
AI Analysis
Technical Summary
This vulnerability in the MaaS API of Red Hat OpenShift AI (RHOAI) arises from the API trusting the HTTP headers X-MaaS-Username and X-MaaS-Group verbatim without first-party authentication. As a result, any pod within the cluster can bypass the Kuadrant AuthPolicy gateway by forging these headers. This authentication bypass leads to privilege escalation, allowing attackers to mint Kubernetes ServiceAccount tokens in other tenants' namespaces, revoke API keys, and exfiltrate sensitive model access configurations. The vulnerability is classified under CWE-290 (Authentication Bypass by Spoofing) and has a CVSS v3.1 base score of 9.9, indicating critical severity. The vendor advisory from Red Hat confirms the issue but does not currently provide a remediation level or patch availability.
Potential Impact
The vulnerability allows unauthorized pods within the cluster to bypass authentication controls, leading to privilege escalation. Attackers can mint Kubernetes ServiceAccount tokens in namespaces of other tenants, revoke API keys, and exfiltrate sensitive configuration data related to model access. This compromises confidentiality, integrity, and availability of the affected system components.
Mitigation Recommendations
Patch status is not yet confirmed — check the Red Hat advisory at https://access.redhat.com/security/cve/CVE-2026-14450 for current remediation guidance. Until a fix is available, consider restricting pod permissions and network policies to limit the ability to forge HTTP headers and access the MaaS API. Engage with Red Hat Technical Account Managers if available for tailored mitigation advice.
CVE-2026-14450: Authentication Bypass by Spoofing in Red Hat Red Hat OpenShift AI (RHOAI)
Description
CVE-2026-14450 is a critical authentication bypass vulnerability in the MaaS API of Red Hat OpenShift AI (RHOAI). It allows any pod within the cluster to forge HTTP headers (X-MaaS-Username and X-MaaS-Group) trusted by the Kuadrant AuthPolicy gateway, bypassing authentication. This enables unauthorized access and privilege escalation, including minting Kubernetes ServiceAccount tokens in other tenants' namespaces, revoking API keys, and exfiltrating sensitive configuration data.
CVSS v3.1
Score 9.9critical
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
This vulnerability in the MaaS API of Red Hat OpenShift AI (RHOAI) arises from the API trusting the HTTP headers X-MaaS-Username and X-MaaS-Group verbatim without first-party authentication. As a result, any pod within the cluster can bypass the Kuadrant AuthPolicy gateway by forging these headers. This authentication bypass leads to privilege escalation, allowing attackers to mint Kubernetes ServiceAccount tokens in other tenants' namespaces, revoke API keys, and exfiltrate sensitive model access configurations. The vulnerability is classified under CWE-290 (Authentication Bypass by Spoofing) and has a CVSS v3.1 base score of 9.9, indicating critical severity. The vendor advisory from Red Hat confirms the issue but does not currently provide a remediation level or patch availability.
Potential Impact
The vulnerability allows unauthorized pods within the cluster to bypass authentication controls, leading to privilege escalation. Attackers can mint Kubernetes ServiceAccount tokens in namespaces of other tenants, revoke API keys, and exfiltrate sensitive configuration data related to model access. This compromises confidentiality, integrity, and availability of the affected system components.
Mitigation Recommendations
Patch status is not yet confirmed — check the Red Hat advisory at https://access.redhat.com/security/cve/CVE-2026-14450 for current remediation guidance. Until a fix is available, consider restricting pod permissions and network policies to limit the ability to forge HTTP headers and access the MaaS API. Engage with Red Hat Technical Account Managers if available for tailored mitigation advice.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- redhat
- Date Reserved
- 2026-07-02T07:39:29.182Z
- Cvss Version
- 3.1
- State
- PUBLISHED
- Remediation Level
- null
- Vendor Advisory Urls
- [{"url":"https://access.redhat.com/security/cve/CVE-2026-14450","vendor":"Red Hat"}]
Threat ID: 6a7a3b13bf8831d5398565e9
Added to database: 08/10/2026, 20:56:51 UTC
Last enriched: 08/10/2026, 21:15:11 UTC
Last updated: 08/10/2026, 23:05:21 UTC
Views: 6
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.