Bug 2496373 (CVE-2026-14450)

Summary:	CVE-2026-14450 maas-billing: MaaS API: Privilege escalation via forged HTTP headers due to missing authentication
Product:	[Other] Security Response	Reporter:	OSIDB Bzimport <bzimport>
Component:	vulnerability	Assignee:	Product Security <prodsec-ir-bot>
Status:	NEW ---	QA Contact:
Severity:	high	Docs Contact:
Priority:	high
Version:	unspecified	CC:	jkoehler, lphiri, security-response-team
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	---
Doc Text:	A flaw was found in the MaaS API. This vulnerability allows any pod within the cluster to bypass the Kuadrant AuthPolicy gateway by forging HTTP headers, specifically `X-MaaS-Username` and `X-MaaS-Group`, which are trusted verbatim. This lack of first-party authentication enables an attacker to gain unauthorized access and escalate privileges. The concrete consequences include the ability to mint Kubernetes ServiceAccount tokens in other tenants' namespaces, revoke API keys, and exfiltrate sensitive model access configuration.	Story Points:	---
Clone Of:		Environment:
Last Closed:		Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:

Description OSIDB Bzimport 2026-07-02 07:21:33 UTC

maas-api performs no first-party authentication. The sole identity source for every protected route (/v1/tokens, /v1/api-keys, /v1/models) is the ExtractUserInfo() gin middleware, which reads X-MaaS-Username and X-MaaS-Group HTTP headers and trusts them verbatim. Without a NetworkPolicy restricting direct pod access, any pod in the cluster can bypass the Kuadrant AuthPolicy gateway and forge requests as any user — minting Kubernetes ServiceAccount tokens (TokenRequest) in other tenants' namespaces, revoking their API keys, and exfiltrating their model access configuration.