CVE-2026-16456: odh-model-controller Info Disclosure Flaw

CVE-2026-16456 Overview

CVE-2026-16456 is an information disclosure vulnerability in the odh-model-controller, a component of Red Hat OpenShift AI. The flaw resides in the loadSecret function, which reads the Secret namespace from user-controlled input without proper validation. Authenticated users with permission to create custom resources can supply arbitrary namespace values to retrieve Secrets outside their authorization boundary. This exposes sensitive API keys and cloud credentials stored in Kubernetes Secrets across other namespaces. The weakness is classified as [CWE-441] (Unintended Proxy or Intermediary, 'Confused Deputy'), as the controller acts on behalf of the user with elevated privileges.

Critical Impact
Authenticated tenants can read Secrets belonging to other namespaces, disclosing API keys and cloud credentials that enable lateral movement across multi-tenant OpenShift AI clusters.

Affected Products

Red Hat OpenShift AI (odh-model-controller component)
Distributions referenced in RHSA-2026:53261, RHSA-2026:53262, and RHSA-2026:53263
Deployments running vulnerable versions of the Open Data Hub model controller

Discovery Timeline

2026-08-10 - CVE-2026-16456 published to NVD
2026-08-11 - Last updated in NVD database

Technical Details for CVE-2026-16456

Vulnerability Analysis

The odh-model-controller reconciles custom resources that describe machine-learning model deployments. During reconciliation, the controller calls loadSecret to fetch credentials required for pulling model artifacts or accessing object storage. The function accepts a namespace value taken from the user-submitted custom resource and passes it directly to the Kubernetes API to retrieve a Secret. Because the controller runs with a service account that has broad cluster-scoped read permissions on Secrets, the requested namespace is not constrained to the caller's own namespace.

An authenticated user who can create the relevant custom resource in one namespace can reference a Secret in an unrelated namespace. The controller then returns credentials the caller could not otherwise read. This is a classic confused-deputy pattern that transforms limited tenant privileges into cross-namespace credential access.

Root Cause

The root cause is missing validation of user-controlled input in loadSecret. The function should confirm the requested Secret resides in the same namespace as the parent custom resource, or perform a SubjectAccessReview against the calling user before dereferencing the Secret.

Attack Vector

The attack requires network access to the OpenShift API and low-privileged authenticated credentials with rights to create the affected custom resources. No user interaction is required. Exploitation is performed by crafting a custom resource that references a Secret name and namespace controlled by another tenant, then observing the controller behavior or errors to confirm disclosure.

See the Red Hat CVE Analysis for CVE-2026-16456 and Red Hat Bug Report #2503159 for vendor technical detail.

Detection Methods for CVE-2026-16456

Indicators of Compromise

Custom resources whose Secret references point to namespaces the creator does not own or administer
Kubernetes audit log entries showing the odh-model-controller service account reading Secrets from unexpected namespaces
Errors or events from the controller referencing Secrets in namespaces outside the resource's own namespace

Detection Strategies

Enable Kubernetes API audit logging at RequestResponse level for secrets resources and correlate Secret reads with the originating custom resource
Alert when the odh-model-controller service account accesses Secrets in namespaces that do not host an owning custom resource
Review custom resource specifications for namespace fields on Secret references and flag cross-namespace values

Monitoring Recommendations

Ingest OpenShift API audit logs into a centralized data lake and build detections for cross-namespace Secret reads by controller service accounts
Baseline normal namespace pairings between custom resources and referenced Secrets, then alert on deviations
Monitor RBAC changes that broaden which principals can create the affected custom resources

How to Mitigate CVE-2026-16456

Immediate Actions Required

Apply the updates delivered in RHSA-2026:53261, RHSA-2026:53262, and RHSA-2026:53263 to affected OpenShift AI clusters
Restrict permission to create the affected custom resources to trusted users until patching completes
Rotate API keys and cloud credentials stored in Secrets that may have been referenced from untrusted namespaces

Patch Information

Red Hat has released fixed versions of odh-model-controller through the advisories listed above. The patched controller validates that Secret references resolve within the requesting namespace, or enforces authorization checks before loading Secret contents. Refer to each advisory for the exact package builds applicable to your Red Hat OpenShift AI channel.

Workarounds

Reduce the blast radius by scoping the controller's Secret read permissions with narrower RBAC where the deployment topology allows
Use Kubernetes admission policies (for example, ValidatingAdmissionPolicy or OPA Gatekeeper) to reject custom resources that reference Secrets outside the resource's own namespace
Segment tenants into separate clusters or projects with independent controller instances when patching cannot be applied immediately

bash

# Example ValidatingAdmissionPolicy pattern to reject cross-namespace Secret references
# Review and adapt to the exact CRD schema used by odh-model-controller before applying
kubectl get crd | grep -i odh
kubectl auth can-i create <odh-crd> --as=<user> -n <namespace>