This vulnerability exists in the odh-dashboard component of Red Hat OpenShift AI 2.16, where a NodeJS endpoint improperly exposes Kubernetes Service Account tokens. Exploitation could allow an attacker with limited privileges to gain unauthorized access to Kubernetes resources. The CVSS 3.1 vector (AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H) indicates network attack vector, high attack complexity, low privileges required, no user interaction, scope change, and high impact on confidentiality, integrity, and availability. Red Hat has published updated container images in version 2.16.4 and accompanying upgrade documentation to remediate the issue.

Successful exploitation of this vulnerability could lead to unauthorized disclosure of Kubernetes Service Account tokens, which may allow attackers to access and manipulate Kubernetes resources beyond their intended permissions. This compromises confidentiality, integrity, and availability of the affected Kubernetes environment managed by Red Hat OpenShift AI 2.16.

Red Hat has released updated images for Red Hat OpenShift AI 2.16.4 that address this vulnerability. Users should follow the official upgrade instructions provided in the Red Hat documentation to update their clusters and fully apply the errata update. Since no explicit patch file is listed, applying the updated container images and performing the upgrade is the recommended remediation. Monitor Red Hat advisories for any further updates or instructions.