CVE-2026-18949 Odh-dashboard: odh-dashboard: clusterrole grants cluster-wide crud on secrets and rbac management resources

A flaw was found in odh-dashboard. This vulnerability allows an attacker, who has compromised the dashboard's Service Account SA token, to exploit overly broad permissions granted to the SA. This enables the attacker to escalate their privileges to cluster-administrator level, gain access to...

CVE-2026-18949

Summary: CVE-2026-18949 affects odh-dashboard. A compromised dashboard Service Account token can be abused due to overly broad SA permissions, enabling escalation to cluster-admin and access to credentials/keys across the cluster, potentially breaking multi-tenant isolation. The CVE description a...

CVE-2026-18608

A flaw was found in the Data Science Pipelines Operator DSPO. The operator's ClusterRole, which defines its permissions, includes extensive privileges beyond what is necessary for its operation. These excessive permissions, such as the ability to execute commands within pods and manage cluster-wi...

CVE-2026-15581 Trustyai-service-operator: trustyai-service-operator: tas internal service bypasses kube-rbac-proxy, exposing unauthenticated quarkus api cluster-wide

A flaw was found in the TrustyAI Service TAS deployment. This vulnerability allows any pod on the cluster network to bypass authentication and directly access the TAS backend API. An attacker can exploit this to read, tamper with, or delete monitoring data and configurations, and inject arbitrary...

CVE-2026-15581

CVE-2026-15581 : A flaw in the TrustyAI Service (TAS) deployment allows any pod on the cluster network to bypass authentication and directly access the TAS backend API, enabling reading, tampering, or deletion of monitoring data and configurations, and injection of arbitrary data into the service...

CVE-2026-15581 Trustyai-service-operator: trustyai-service-operator: tas internal service bypasses kube-rbac-proxy, exposing unauthenticated quarkus api cluster-wide

A flaw was found in the TrustyAI Service TAS deployment. This vulnerability allows any pod on the cluster network to bypass authentication and directly access the TAS backend API. An attacker can exploit this to read, tamper with, or delete monitoring data and configurations, and inject arbitrary...

CVE-2026-15467

A flaw was found in the trustyai-service-operator's LMEvalJob controller. An authenticated user within the cluster can exploit this vulnerability by configuring a sidecar container to bypass existing security policies. This allows the user to enable and execute untrusted remote code, leading to...

CVE-2026-72886 Dokploy: Non-admin member gains root on the host by bypassing the owner/admin check on server-level schedules (incomplete fix of CVE-2026-45632)

Dokploy is a free, self-hostable Platform as a Service PaaS. From 0.29.2 until 0.29.13, schedule.create and schedule.update in apps/dokploy/server/api/routers/schedule.ts derive serviceId from applicationId or composeId and execute the owner/admin host-schedule gate only in the alternative branch...

CVE-2026-72886

Dokploy is a free, self-hostable Platform as a Service PaaS. From 0.29.2 until 0.29.13, schedule.create and schedule.update in apps/dokploy/server/api/routers/schedule.ts derive serviceId from applicationId or composeId and execute the owner/admin host-schedule gate only in the alternative branch...

CVE-2026-72873 Dokploy: Cross-tenant Git provider secrets are disclosed to low-privileged service readers via `application.one`

Dokploy is a free, self-hostable Platform as a Service PaaS. Prior to 0.29.13, application.one in apps/dokploy/server/api/routers/application.ts returns provider relations loaded by findApplicationById in packages/server/src/services/application.ts without redacting githubClientSecret,...

PT-2026-69957

Name of the Vulnerable Software and Affected Versions Data Science Pipelines Operator affected versions not specified Description A flaw exists in the Data Science Pipelines Operator where a namespace editor can inject dangerous parameters into the MySQL Data Source Name DSN string via the...

PT-2026-69966

Name of the Vulnerable Software and Affected Versions odh-dashboard affected versions not specified Description An authenticated user can exploit a flaw in the creation of RoleBindings. The system fails to properly validate the roleRef field, enabling a user to assign arbitrary roles, such as...

PT-2026-69967

Name of the Vulnerable Software and Affected Versions Red Hat OpenShift AI RHOAI affected versions not specified Description A flaw exists in the Red Hat OpenShift AI RHOAI overlay for the training operator. The overlay incorrectly aggregates management permissions for trainjobs into the native...

CVE-2026-71325

Traefik is an open-source edge router that makes publishing services a fun and easy experience. Prior to 2.11.54, 3.6.25, and 3.7.10, cross-namespace @kubernetescrd references are not rejected for TraefikService backend references resolved by the service resolver. A tenant confined by RBAC to a...

GHSA-62FC-8686-HFMQ Traefik: `allowCrossNamespace=false` bypass via `@kubernetescrd` TraefikService backendRef

Summary There is a medium severity vulnerability in Traefik's Kubernetes CRD provider. When providers.kubernetesCRD.allowCrossNamespace is disabled — the default — cross-namespace @kubernetescrd references are rejected for middlewares, TLS options and HTTP/TCP ServersTransports, but the same...

CVE-2026-71325

Traefik exposes a cross-namespace bypass for TraefikService backends via @kubernetescrd references. The CVE affects Traefik’s Kubernetes CRD service resolver: when the reference name contains an @kubernetescrd, the resolver’s guard for cross-namespace references is not enforced for TraefikService...

PT-2026-68085

Name of the Vulnerable Software and Affected Versions Red Hat Advanced Cluster Management for Kubernetes ACM affected versions not specified Description A flaw in the Application Subscription controller multicluster-operators-subscription allows a user with namespace-scoped edit privileges in an...

CLEANSTART-2026-JB31481 Security fixes in kube-rbac-proxy-fips 0.17.1-r1

Package kube-rbac-proxy-fips version 0.17.1-r1 fixes 2 vulnerabilities: CVE-2025-61727, CVE-2025-61729...

CLEANSTART-2026-GX03760 Security fixes in kube-rbac-proxy 0.20.0-r0

Package kube-rbac-proxy version 0.20.0-r0 fixes 1 vulnerabilities: ghsa-9h8m-3fm2-qjrq...

CVE-2026-55707

An authorization bypass was found in the OpenStack Neutron subnetpool onboarding API endpoint PUT /v2.0/subnetpools/id/onboardnetworksubnets. When a caller supplies a networkid, the API only verifies that the network is visible to the caller but does not verify that the caller owns the subnets on...