CVE-2026-5483

CriticalCVSS 9.9/10Last modified Oct 26, 2026

Description

A flaw was found in odh-dashboard in Red Hat Openshift AI. This vulnerability in the `odh-dashboard` component of Red Hat OpenShift AI (RHOAI) allows for the disclosure of Kubernetes Service Account tokens through a NodeJS endpoint. This could enable an attacker to gain unauthorized access to Kubernetes resources.

Metrics

CVSS 3.1 9.9/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Weakness enumeration

CWE-201

Affected software

VendorProductVersions
Red HatRed Hat OpenShift AI 2.16—
Red HatRed Hat OpenShift AI 2.25—
Red HatRed Hat OpenShift AI 3.2—
Red HatRed Hat OpenShift AI 3.3—
Red HatRed Hat OpenShift AI (RHOAI)—
Red HatRed Hat OpenShift AI (RHOAI)—
Red HatRed Hat OpenShift AI (RHOAI)—
Red HatRed Hat OpenShift AI 2.16—
Red HatRed Hat OpenShift AI 2.25—
Red HatRed Hat OpenShift AI 3.2—
Red HatRed Hat OpenShift AI 3.3—
Red HatRed Hat OpenShift AI (RHOAI)—
Red HatRed Hat OpenShift AI (RHOAI)—
Red HatRed Hat OpenShift AI (RHOAI)—

References

Timeline

Published
Apr 10, 2026
Last modified
Oct 26, 2026
NVD status
Modified

Related CVEs from 2026

CVE-2026-548307.5Unauthenticated Broken Access Control in Five Star Restaurant Reservations <= 2.7.19 versions.CVE-2026-548319.3Unauthenticated SQL Injection in GeoDirectory <= 2.8.162 versions.CVE-2026-548327.5Unauthenticated Broken Access Control in Gutenverse Companion <= 2.5.0 versions.CVE-2026-548337.4Unauthenticated Backdoor in Enable CORS <= 2.0.3 versions.CVE-2026-548347.5Unauthenticated Sensitive Data Exposure in Object Cache 4 everyone <= 2.3.2 versions.CVE-2026-548357.5Unauthenticated Broken Access Control in Five Star Restaurant Menu <= 2.5.2 versions.CVE-2026-548369.3Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in YMC Filter allows SQL Injection. ThisCVE-2026-548377.5Unauthenticated Broken Access Control in Intranet &amp; Private Site &#8211; All-In-One Intranet <= 1.8.1 versions.CVE-2026-548388.5Subscriber SQL Injection in WC Vendors Marketplace <= 2.6.8 versions.CVE-2026-548397.5Unauthenticated Sensitive Data Exposure in Trinity Backup &#8211; Backup, Migrate, Restore, Clone &amp; Schedule Backups <= 2.0.9 versions.CVE-2026-54845.3A weakness has been identified in BookStackApp BookStack up to 26.03. Affected is the function chapterToMarkdown of the file app/Exports/ExpCVE-2026-548407.3Unauthenticated Broken Access Control in Newsletters <= 4.13 versions.
CVE-2026-5483: Critical severity, CVSS 9.9 | Vulnix