CVE-2026-5483 is a high severity flaw (CVSS 8.5) in the odh-dashboard component of Red Hat OpenShift AI. A NodeJS endpoint can return the dashboard's Kubernetes service account token to an authenticated user. Red Hat shipped errata on 10 April 2026, including RHOAI 2.16.4 and 2.25.4.
What's affected
- Red Hat OpenShift AI, odh-dashboard component, per the record.
- Fixed in the errata RHSA-2026:7397 (RHOAI 2.16.4) and RHSA-2026:7398 (RHOAI 2.25.4). The record lists two more errata, RHSA-2026:7403 and RHSA-2026:7404, which were not read for this post. Check them for the other release lines.
- Red Hat says exploitation needs authenticated access to the dashboard, and for 2.25 and later, a NIM account custom resource on the cluster.
How to check if you're exposed
Check which OpenShift AI version is installed from the operator page in the OpenShift console, or with oc get csv -A | grep -i rhods. Compare it with the errata above. Then see whether the NIM account custom resource exists on the cluster, since Red Hat lists it as a requirement for 2.25 and later. Also list who can sign in to the dashboard.
What to do now
- Read the Red Hat CVE page and the listed errata for your release line.
- Update OpenShift AI to the fixed release by following the upgrade instructions in the errata.
- Review the permissions of the dashboard service account and reduce them if they are broader than needed.
- If you cannot rule out misuse, rotate the service account token as Red Hat advises for token exposure, and review API audit logs for its use.
Why it matters
The class is CWE-201, insertion of sensitive information into externally accessible resources. The Red Hat statement says the NIM serving endpoint returned the full Kubernetes client response, and that response included the dashboard's own service account token.
A service account token acts as the identity of the dashboard inside the cluster, so whoever holds it can do what the dashboard can do. The record does not mark the CVE as exploited in the wild. The general lesson is to return only the fields a client needs and never a raw response from an internal client.
For your own projects, the free in-browser dependency scan needs no install, and the Gold directory tracks this CVE.
Quick check
Can an anonymous user get the token?
Red Hat lists authenticated access to the dashboard as a requirement.
Sources
- https://access.redhat.com/security/cve/CVE-2026-5483
- https://access.redhat.com/errata/RHSA-2026:7397
- https://access.redhat.com/errata/RHSA-2026:7398
Last reviewed: 19 October 2026.
