CVE-2026-5483: Insertion of Sensitive Information Into Sent Data in Red Hat Red Hat OpenShift AI 2.16
A flaw was found in odh-dashboard in Red Hat Openshift AI. This vulnerability in the `odh-dashboard` component of Red Hat OpenShift AI (RHOAI) allows for the disclosure of Kubernetes Service Account tokens through a NodeJS endpoint. This could enable an attacker to gain unauthorized access to Kubernetes resources.
AI Analysis
Technical Summary
A vulnerability exists in the odh-dashboard component of Red Hat OpenShift AI (RHOAI) 2.16, identified as CVE-2026-5483, which permits disclosure of Kubernetes Service Account tokens through a NodeJS endpoint. This flaw could allow an attacker to gain unauthorized access to Kubernetes resources. The CVSS v3.1 base score is 8.5, reflecting high severity with network attack vector, high impact on confidentiality, integrity, and availability, and requiring low privileges but high attack complexity. Red Hat has published security advisories RHSA-2026:7397 and RHSA-2026:7398 with updated container images for RHOAI 2.16.4 and 2.25.4 respectively. The advisories instruct users to upgrade their clusters following official documentation. However, the advisories do not explicitly confirm that the vulnerability is fixed in these releases.
Potential Impact
Successful exploitation of this vulnerability could disclose Kubernetes Service Account tokens, which may allow an attacker to access and manipulate Kubernetes resources without authorization. This can lead to a compromise of cluster confidentiality, integrity, and availability. The CVSS score of 8.5 indicates a high impact. There are no known exploits in the wild at this time.
Mitigation Recommendations
Red Hat has released updated images for Red Hat OpenShift AI versions 2.16.4 and 2.25.4. Users should upgrade their clusters to these versions following the official Red Hat OpenShift AI upgrade documentation to apply the errata updates. The advisories do not explicitly state that the vulnerability is fixed, so users should verify the status post-upgrade and monitor Red Hat advisories for further updates. Patch status is not yet confirmed explicitly; check the vendor advisory for current remediation guidance.
CVE-2026-5483: Insertion of Sensitive Information Into Sent Data in Red Hat Red Hat OpenShift AI 2.16
Description
A flaw was found in odh-dashboard in Red Hat Openshift AI. This vulnerability in the `odh-dashboard` component of Red Hat OpenShift AI (RHOAI) allows for the disclosure of Kubernetes Service Account tokens through a NodeJS endpoint. This could enable an attacker to gain unauthorized access to Kubernetes resources.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
A vulnerability exists in the odh-dashboard component of Red Hat OpenShift AI (RHOAI) 2.16, identified as CVE-2026-5483, which permits disclosure of Kubernetes Service Account tokens through a NodeJS endpoint. This flaw could allow an attacker to gain unauthorized access to Kubernetes resources. The CVSS v3.1 base score is 8.5, reflecting high severity with network attack vector, high impact on confidentiality, integrity, and availability, and requiring low privileges but high attack complexity. Red Hat has published security advisories RHSA-2026:7397 and RHSA-2026:7398 with updated container images for RHOAI 2.16.4 and 2.25.4 respectively. The advisories instruct users to upgrade their clusters following official documentation. However, the advisories do not explicitly confirm that the vulnerability is fixed in these releases.
Potential Impact
Successful exploitation of this vulnerability could disclose Kubernetes Service Account tokens, which may allow an attacker to access and manipulate Kubernetes resources without authorization. This can lead to a compromise of cluster confidentiality, integrity, and availability. The CVSS score of 8.5 indicates a high impact. There are no known exploits in the wild at this time.
Mitigation Recommendations
Red Hat has released updated images for Red Hat OpenShift AI versions 2.16.4 and 2.25.4. Users should upgrade their clusters to these versions following the official Red Hat OpenShift AI upgrade documentation to apply the errata updates. The advisories do not explicitly state that the vulnerability is fixed, so users should verify the status post-upgrade and monitor Red Hat advisories for further updates. Patch status is not yet confirmed explicitly; check the vendor advisory for current remediation guidance.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- redhat
- Date Reserved
- 2026-04-03T12:27:18.589Z
- Cvss Version
- 3.1
- State
- PUBLISHED
- Remediation Level
- null
- Vendor Advisory Urls
- [{"url":"https://access.redhat.com/errata/RHSA-2026:7397","vendor":"Red Hat"},{"url":"https://access.redhat.com/security/cve/CVE-2026-5483","vendor":"Red Hat"}]
Threat ID: 69d938791cc7ad14dad9528c
Added to database: 4/10/2026, 5:50:49 PM
Last enriched: 4/30/2026, 2:44:09 AM
Last updated: 5/26/2026, 7:56:46 AM
Views: 116
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.