A vulnerability (CVE-2026-5483) exists in the odh-dashboard component of Red Hat OpenShift AI 2.16 that permits disclosure of Kubernetes Service Account tokens through a NodeJS endpoint. This flaw could allow an attacker with network access to the endpoint to obtain sensitive tokens, leading to unauthorized access to Kubernetes resources. The CVSS 3.1 base score is 8.5, indicating high severity with network attack vector, high impact on confidentiality, integrity, and availability, and requiring low privileges but high attack complexity. Red Hat has issued security advisories RHSA-2026:7397 and RHSA-2026:7398 with updated container images for OpenShift AI 2.16.4 and 2.25.4 respectively. The advisories recommend upgrading to these versions to mitigate the vulnerability. However, explicit patch details or remediation instructions are not yet fully documented in the advisories.

Successful exploitation of this vulnerability can lead to disclosure of Kubernetes Service Account tokens, which are sensitive credentials used for authentication within Kubernetes clusters. This disclosure can enable attackers to gain unauthorized access to Kubernetes resources, potentially compromising cluster security, data confidentiality, integrity, and availability. The CVSS score of 8.5 reflects a high impact on confidentiality, integrity, and availability.

Red Hat has released updated container images for Red Hat OpenShift AI versions 2.16.4 and 2.25.4 that address this vulnerability. Users should upgrade their OpenShift AI clusters to these versions following the official Red Hat documentation and upgrade instructions at https://docs.redhat.com/en/documentation/red_hat_openshift_ai/. Patch status is not explicitly confirmed beyond the availability of updated images; therefore, users should apply these updates promptly to mitigate the risk. Monitor Red Hat advisories for further detailed remediation guidance.