CVE-2026-16745: Red Hat OpenShift AI Auth Bypass Flaw

CVE-2026-16745 Overview

CVE-2026-16745 is an authentication bypass vulnerability in odh-dashboard, the web console component of Red Hat OpenShift AI (RHOAI). The flaw stems from incorrect network binding, which allows a malicious actor inside the cluster to impersonate any user by supplying an arbitrary access token. Successful exploitation grants unauthorized access to the Kubernetes API. Attackers can then execute arbitrary code, escalate privileges, or disclose sensitive information across the cluster. The weakness maps to CWE-346: Origin Validation Error.

Critical Impact
An in-cluster attacker can bypass authentication in odh-dashboard, impersonate arbitrary users, and gain full Kubernetes API access — enabling code execution, privilege escalation, and data disclosure.

Affected Products

Red Hat OpenShift AI (RHOAI)
odh-dashboard web console component
Open Data Hub deployments using the affected odh-dashboard builds

Discovery Timeline

2026-07-23 - CVE-2026-16745 published to the National Vulnerability Database
2026-07-23 - Last updated in NVD database

Technical Details for CVE-2026-16745

Vulnerability Analysis

The odh-dashboard service exposes an interface that should validate user identity before forwarding requests to the Kubernetes API. Because of incorrect network binding, the component accepts access tokens without validating their origin or authenticity. An attacker inside the cluster can present any token string and the dashboard treats it as valid.

This defect breaks the trust boundary between the dashboard and the API server. Requests submitted through the dashboard are executed with the impersonated user's privileges. If that user is a cluster administrator or a high-privilege service account, the attacker inherits full control over workloads, secrets, and pipelines.

The attack requires low-privileged access on an adjacent workload but no user interaction. Confidentiality, integrity, and availability are all directly affected.

Root Cause

The root cause is an origin validation failure [CWE-346]. The dashboard binds to a network interface that is reachable from other in-cluster workloads and trusts the supplied bearer token without verifying it against the OpenShift OAuth server. This missing verification step enables identity impersonation for any principal known to the API.

Attack Vector

An attacker with a foothold on any pod, node, or service account within the OpenShift cluster sends an HTTP request to the odh-dashboard endpoint. The request includes a crafted Authorization: Bearer <token> header naming the target identity. The dashboard forwards the impersonated request to the Kubernetes API, returning results such as secrets, configmaps, or the ability to create privileged workloads. No credential theft is required because the token content is not validated.

See the Red Hat CVE-2026-16745 Advisory and the Red Hat Bug Report #2506350 for vendor technical details.

Detection Methods for CVE-2026-16745

Indicators of Compromise

Unexpected requests to the odh-dashboard service from pods outside the RHOAI namespace.
Kubernetes audit log entries showing API actions performed on behalf of users who did not authenticate through the OAuth flow.
Creation of new ServiceAccounts, RoleBindings, or privileged pods sourced from the odh-dashboard pod identity.
Access to Secrets or ConfigMaps in namespaces unrelated to normal RHOAI workflows.

Detection Strategies

Enable Kubernetes API audit logging at the RequestResponse level and alert on impersonation headers combined with high-value verbs such as create, patch, or delete on secrets and clusterrolebindings.
Correlate odh-dashboard pod network flows with unusual source pods or namespaces using CNI or service mesh telemetry.
Baseline expected user activity on the dashboard and flag token-based sessions that lack a corresponding OAuth login event.

Monitoring Recommendations

Ship OpenShift audit logs and RHOAI application logs to a centralized analytics platform for retention and correlation.
Monitor for privilege escalation patterns such as ServiceAccount token creation followed by ClusterRoleBinding changes.
Track anomalous east-west traffic to odh-dashboard from workloads that historically do not communicate with it.

How to Mitigate CVE-2026-16745

Immediate Actions Required

Apply the patched odh-dashboard release referenced in the Red Hat CVE-2026-16745 Advisory as soon as it is available for your channel.
Restrict network reachability to the odh-dashboard service using NetworkPolicies that only allow traffic from the OpenShift router and authenticated ingress paths.
Rotate service account tokens and user credentials that could have been impersonated during the exposure window.
Review Kubernetes audit logs for any unauthorized API calls that reference the dashboard's pod identity.

Patch Information

Red Hat tracks the fix under Bugzilla #2506350. Consult the Red Hat CVE-2026-16745 Advisory for fixed package versions, errata identifiers, and supported RHOAI channels. Update odh-dashboard to the fixed release and redeploy affected pods so the corrected binding takes effect.

Workarounds

Apply a Kubernetes NetworkPolicy that limits ingress to the odh-dashboard pods to the OpenShift ingress controller only, blocking pod-to-pod access from other namespaces.
Temporarily scale down odh-dashboard in clusters where RHOAI is not actively used until patched builds are deployed.
Enforce Pod Security Admission and least-privilege ServiceAccount bindings so any impersonated identity has minimal cluster rights.

bash

# Example NetworkPolicy restricting access to odh-dashboard
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: restrict-odh-dashboard
  namespace: redhat-ods-applications
spec:
  podSelector:
    matchLabels:
      app: odh-dashboard
  policyTypes:
    - Ingress
  ingress:
    - from:
        - namespaceSelector:
            matchLabels:
              network.openshift.io/policy-group: ingress