CVE-2026-5483 is a vulnerability in the odh-dashboard component of Red Hat OpenShift AI that allows disclosure of Kubernetes Service Account tokens through the NIM serving API endpoint (/api/nim-serving/:nimResource). The endpoint returns the full Kubernetes client response including the dashboard's service account token, which could be exploited by an authenticated user to access Kubernetes resources unauthorizedly. Exploitation requires authenticated access to the dashboard and the existence of the NIM account Custom Resource on the cluster (for versions 2.25+). If the secret referenced by the Account CR is not created, the endpoint returns a 404 without leaking tokens. The vulnerability is tracked under CWE-201 (Insertion of Sensitive Information Into Sent Data).

Disclosure of Kubernetes Service Account tokens can lead to unauthorized access to Kubernetes resources within the OpenShift AI environment, potentially allowing attackers to perform actions with the privileges of the compromised service account. This impacts confidentiality, integrity, and availability of the affected system components. The vulnerability is rated as high severity by Red Hat.

A fix is available in Red Hat OpenShift AI version 2.16.4. Users should upgrade to this version following the vendor's upgrade documentation. If immediate upgrading is not possible, the vulnerability can be mitigated by disabling or removing the NVIDIA Inference Microservice (NIM) integration from the Red Hat OpenShift AI environment. No other mitigations are specified by the vendor advisory.