CVE-2026-86332: Missing Authorization in Red Hat Red Hat OpenShift AI 2.25

A missing authorization flaw (CWE-862) exists in the odh-dashboard component of Red Hat OpenShift AI. Specifically, the GET /api/nim-serving/:nimResource route reads Kubernetes Secrets using the dashboard service account and returns the full Secret object including sensitive .data fields without verifying if the requesting user is authorized. This allows any authenticated dashboard user to retrieve critical secrets such as the cluster NVIDIA NGC API key (apiKeySecret) and the NIM image pull secret (nimPullSecret). Although creation and deletion of these credentials are restricted to admin users, the read path is not protected, leading to exposure of sensitive credentials (CWE-522). This vulnerability is separate from CVE-2026-5483 and CVE-2026-16456, which affect other components or aspects of the product. The CVSS v3.1 score is 6.5 (medium severity) with vector AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N, indicating network attack vector, low attack complexity, requiring low privileges, no user interaction, unchanged scope, high confidentiality impact, no integrity or availability impact. The vendor advisory does not explicitly confirm a patch or remediation for this specific CVE as of the advisory date.

Any authenticated user of the odh-dashboard can read sensitive Kubernetes Secrets containing credentials such as the NVIDIA NGC API key and image pull secrets. This exposure can lead to unauthorized access to protected resources or services that rely on these credentials. The vulnerability does not allow modification or deletion of these secrets without admin privileges, limiting the impact to confidentiality loss only. There is no indication of active exploitation in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. The Red Hat advisory linked does not explicitly mention a fix for CVE-2026-86332. Until a patch is available, restrict dashboard user access to trusted personnel only and monitor for unauthorized access. Follow Red Hat's official documentation and errata updates for instructions on upgrading once a fix is released.