CVE-2024-7557
Odh-dashboard: odh-model-controller: cross-model authentication bypass in openshift ai
- Published
- Updated
- Reserved
- Assigned by
- redhat
Description
A vulnerability was found in OpenShift AI that allows for authentication bypass and privilege escalation across models within the same namespace. When deploying AI models, the UI provides the option to protect models with authentication. However, credentials from one model can be used to access other models and APIs within the same namespace. The exposed ServiceAccount tokens, visible in the UI, can be utilized with oc --token={token} to exploit the elevated view privileges associated with the ServiceAccount, leading to unauthorized access to additional resources.
Timeline
ID reserved
By redhat
- 2 days later
· 2 days later
Published
- 2 years later
· 2 years later
Record updated
Changes after publication (a new score, a public exploit, EPSS crossing 1, 10 or 50 %, leaving KEV) are kept since November 2026; earlier ones are not known.
Scores
| Scored by | CVSS | Score | Vector |
|---|---|---|---|
| redhatCNA (assigner) | 3.1 | High8.8 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
| NVDNVD · Modified | 3.1 | High8.8 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
- EPSS (exploitation in 30 days)
- 0.98% · top 38% of all CVEs (7 Nov 2026)
- CISA SSVC
- Exploitation: none · Automatable: no · Technical impact: total
The list uses the assigner's score when there is one, then CISA's, then NVD's: High 8.8.
Weakness
Affected products
odh-dashboard
- affected 2.8.*
- affected 2.11
- unaffected a122ad06a297f4e8b2a065eece910aa882cc3fa6
- unaffected v2.14.0-11 – < *
- unaffected v2.14.0-11 – < *
- unaffected v2.14.0-5 – < *
- unaffected v2.14.0-5 – < *
- unaffected v2.14.0-6 – < *
- unaffected v2.14.0-7 – < *
- unaffected v2.14.0-5 – < *
- unaffected v2.14.0-8 – < *
- unaffected v2.14.0-5 – < *
- unaffected v2.14.0-5 – < *
- unaffected v2.14.0-6 – < *
- unaffected v2.14.0-5 – < *
- unaffected v2.14.0-5 – < *
- unaffected v2.14.0-6 – < *
- unaffected v2.14.0-6 – < *
- unaffected v2.14.0-5 – < *
- unaffected v2.14.0-6 – < *
- unaffected v2.14.0-5 – < *
- unaffected v2.14.0-6 – < *
- unaffected v2.14.0-5 – < *
- unaffected v2.14.0-10 – < *
- unaffected v2.14.0-40 – < *
- unaffected v2.14.0-6 – < *
- unaffected v2.14.0-7 – < *
- unaffected v2.14.0-6 – < *
- unaffected v2.14.0-6 – < *
- unaffected v2.14.0-9 – < *
- unaffected v2.14.0-46 – < *
- unaffected v2.14.0-24 – < *
- unaffected v2.14.0-6 – < *
- unaffected v2.14.0-6 – < *
- unaffected v2.14.0-40 – < *
Red Hat · Red Hat OpenShift Data Science (RHODS)
All versions: affected
Red Hat · Red Hat OpenShift Data Science (RHODS)
All versions: affected
What to do
Workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
References (4)
- RHBA-2024:8240 (opens in a new tab)vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/security/cve/CVE-2024-7557 (opens in a new tab)vdb-entryx_refsource_REDHAT
- RHBZ#2303094 (opens in a new tab)issue-trackingx_refsource_REDHAT
- https://github.com/opendatahub-io/odh-dashboard/pull/3198 (opens in a new tab)
Sources
The same CVE in the primary databases and aggregators, to check against.
- CVE.org record (opens in a new tab)
- CVE List JSON (GitHub) (opens in a new tab)
- NVD (opens in a new tab)
- FIRST EPSS (opens in a new tab)
- OSV.dev (opens in a new tab)
- GitHub Advisories (opens in a new tab)
- CIRCL Vulnerability-Lookup (opens in a new tab)
Badge for a README or a ticket
[](https://trackcve.app/cve/CVE-2024-7557)Record last updated .