{"id":"CVE-2026-16745","url":"https://www.cyber-defence.io/tools/cve/CVE-2026-16745","generatedAt":"2026-10-28T02:11:40.004Z","title":"Due to incorrect network binding, a malicious actor within the cluster can bypass authentication and impersonate any user by providing an arbitrary access token.","description":"A flaw was found in odh-dashboard, the web console component of Red Hat OpenShift AI (RHOAI). Due to incorrect network binding, a malicious actor within the cluster can bypass authentication and impersonate any user by providing an arbitrary access token. This allows an attacker to gain unauthorized access to the Kubernetes API, potentially leading to arbitrary code execution, privilege escalation, or information disclosure.","published":"2026-07-23T11:16:40.000Z","lastModified":"2026-10-24T13:10:00.000Z","status":"Awaiting Analysis","sourceIdentifier":"secalert@redhat.com","cvss":{"version":"3.1","score":8.8,"severity":"HIGH","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"},"cwe":["CWE-346"],"affected":[],"epss":{"score":0.00465,"percentile":0.40017,"date":"2026-10-26","history":[]},"kev":{"listed":false},"exploits":{"count":0,"verified":false,"firstPublished":null,"source":"Exploit-DB (https://gitlab.com/exploit-database/exploitdb)","entries":[]},"verdict":{"level":"high","text":"High impact if exploited, but EPSS currently rates exploitation as unlikely (0.46%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit."},"changes":[],"references":[{"url":"https://access.redhat.com/errata/RHSA-2026:53261","source":"secalert@redhat.com"},{"url":"https://access.redhat.com/errata/RHSA-2026:53262","source":"secalert@redhat.com"},{"url":"https://access.redhat.com/errata/RHSA-2026:53263","source":"secalert@redhat.com"},{"url":"https://access.redhat.com/errata/RHSA-2026:60520","source":"secalert@redhat.com"},{"url":"https://access.redhat.com/errata/RHSA-2026:65126","source":"secalert@redhat.com"},{"url":"https://access.redhat.com/errata/RHSA-2026:73987","source":"secalert@redhat.com"},{"url":"https://access.redhat.com/security/cve/CVE-2026-16745","source":"secalert@redhat.com"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2506350","source":"secalert@redhat.com"}],"sources":{"nvd":"https://nvd.nist.gov/vuln/detail/CVE-2026-16745","epss":"https://www.first.org/epss/","kev":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","exploitdb":"https://www.exploit-db.com/"},"licence":"CC BY 4.0 — link back to the CVE Explorer if you publish the results; upstream data remains subject to its own terms."}