The vulnerability in Red Hat OpenShift AI's odh-dashboard arises from improper validation of the roleRef field when creating RoleBindings. Authenticated users can exploit this flaw to assign themselves arbitrary ClusterRoles, including the cluster-admin role, within their namespace. This results in privilege escalation and potential persistent elevated access. The issue requires an authenticated user and the dashboard component to be enabled. Red Hat's advisory recommends restricting dashboard access to trusted users and enforcing policies via Open Policy Agent or Gatekeeper to block RoleBindings referencing privileged roles. Audit log monitoring is also advised. No explicit patch or fix release is confirmed in the advisory at this time.

An authenticated user of the odh-dashboard can escalate privileges by creating RoleBindings that reference arbitrary ClusterRoles, including highly privileged ones like cluster-admin. This leads to unauthorized elevated access within the user's namespace and may allow persistent control over the system. The vulnerability impacts confidentiality, integrity, and availability with high severity (CVSS 8.8). It requires low privileges to exploit (authenticated user) and no user interaction beyond authentication.

Currently, no official patch or fix is confirmed for this vulnerability. To mitigate the risk, restrict access to the OpenShift AI dashboard to trusted users only. Implement Open Policy Agent (OPA) or Gatekeeper policies to prevent creation of RoleBindings that reference privileged ClusterRoles such as cluster-admin within user namespaces. Additionally, regularly monitor audit logs for unauthorized RoleBinding creations. Follow updates from Red Hat for any forthcoming official fixes.