Bug 2511168 (CVE-2026-18949)

Description

Description of problem
The odh-dashboard ClusterRole grants cluster-wide CRUD on secrets, configmaps, PVCs (lines 56-68) and cluster-wide RBAC management (rolebindings, clusterrolebindings, roles at lines 134-148).

Verified on live OCP 4.21 cluster: the dashboard SA can read 631 secrets cluster-wide and create ClusterRoleBindings, enabling cluster-admin escalation post-compromise.

File: manifests/core-bases/base/sa-rbac/cluster-role.yaml

NOTE: This finding is NOT covered by CVE-2026-2353, which tracks other RHOAI operators (feast, notebook-controller, model-controller, trustyai, DSPO, KubeRay) but not the dashboard.

Impact:

631 secrets readable cluster-wide (registry credentials, TLS keys, AWS credentials)

ClusterRoleBinding creation confirmed (full cluster-admin escalation)

Secret deletion cluster-wide

Persistent backdoor access via CRB creation

Multi-tenant isolation BROKEN

Prerequisites
RHOAI/ODH with dashboard component enabled

Compromise of the dashboard SA token (via container escape, dependency vulnerability, supply chain attack, or the header spoofing chain from the red team assessment)

The dashboard SA token is mounted in 8-9 containers within the dashboard pod, increasing the attack surface

Steps to Reproduce
Verify dashboard SA permissions:



oc auth can-i --list --as=system:serviceaccount:opendatahub:odh-dashboard
Verify cluster-wide secret access:



oc get secrets --all-namespaces --as=system:serviceaccount:opendatahub:odh-dashboard --no-headers | wc -l
# Expected: 631+
Verify CRB creation:



oc auth can-i create clusterrolebindings --as=system:serviceaccount:opendatahub:odh-dashboard
# Expected: yes
Actual results
ODH on OCP 4.21 (verified 2026-06-16):

Dashboard SA can read 631 secrets cluster-wide

Dashboard SA can create ClusterRoleBindings (cluster-admin escalation)

Dashboard SA can delete secrets cluster-wide

Dashboard SA cannot create pods in kube-system (partial mitigation)

8-9 containers in the dashboard pod share this SA token

Expected results
Secret/configmap/PVC access should be scoped to dashboard and user namespaces only (namespace-scoped Role + RoleBinding)

ClusterRoleBindings CRUD should be removed (namespace-scoped rolebindings should suffice for image puller roles)

Apply least-privilege per namespace

Reproducibility
Always - 100% reproducible.

Found in what build
CONFIRMED VULNERABLE:

ODH on OCP 4.21 (odh-dashboard image: odh-dashboard-f45cd6bb4)

LIKELY VULNERABLE:

All RHOAI 2.x and 3.x versions with dashboard enabled (same ClusterRole definition)

Describe any workarounds
Restrict access to the opendatahub namespace (limit who can compromise the dashboard pod)

Implement egress NetworkPolicy to restrict dashboard outbound traffic

Monitor for unexpected ClusterRoleBinding creation (audit log alerting)

Additional information
Root Cause:



# manifests/core-bases/base/sa-rbac/cluster-role.yaml lines 56-68
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: odh-dashboard
rules:
  - apiGroups: [""]
    resources: [secrets, configmaps, persistentvolumeclaims]
    verbs: [create, delete, get, list, patch, update, watch]
  # lines 134-148
  - apiGroups: [rbac.authorization.k8s.io]
    resources: [rolebindings, clusterrolebindings, roles]
    verbs: [list, get, create, patch, delete]
CWEs:

CWE-250: Execution with Unnecessary Privileges

CWE-269: Improper Privilege Management

Discovery Method:

Project Glasswing (Mythos) automated security audit, verified via live cluster testing on OCP 4.21.