2026-04-10 · 2026-Q2
Red Hat OpenShift AI odh-dashboard Kubernetes Token Disclosure
Should this run hold this key at all?
- Fixable
- Vendor patch
- Vendor response
- Unknown
- In the wild
- No
- Actor
- Attacker
Target
Red Hat OpenShift AI (odh-dashboard component)
Impact
Kubernetes Service Account tokens disclosed via a NodeJS endpoint; disclosed tokens usable to authenticate to the Kubernetes API and reach cluster resources
Root cause
Insecure handling/exposure of token data on a NodeJS endpoint in odh-dashboard
CVE
Sources
Catalog
Cite this: AgentProv incident record: Red Hat OpenShift AI odh-dashboard Kubernetes Token Disclosure (2026-04-10). https://agentprov.com/incidents/2026-04-10-red-hat-openshift-ai-odh-dashboard-kubernetes-token-disclosure
Related
- Also L1 · 2026-10-21LiteLLM 1.107.0 on PyPI and Docker Ships a Credential Stealer That Runs at Every Python StartupL1Credential
- Also L1 · 2026-10-17OpenCode Console Breach Exposes Users' Stored OpenAI, Anthropic, and Google API KeysL1Credential
- Also L1 · 2026-10-13IBM MCP Context Forge Shipped a Known JWT Secret, Letting Anyone Mint Platform Admin Tokens (CVE-2026-53709)L1Credential