Models-as-a-service: red hat openshift ai: maas-api and maas-controller serviceaccounts with excessive permissions lead to privilege escalation
A flaw was found in the maas-api and maas-controller ServiceAccounts within Red Hat OpenShift AI. These ServiceAccounts are granted cluster-wide permissions that exceed their operational requirements. An attacker who compromises the identity of these ServiceAccounts, either through a remote code execution vulnerability or by creating a malicious pod in the same namespace, could exploit these excessive permissions. This could lead to full cluster administrator privileges through the creation of new ClusterRoleBindings or the disclosure of sensitive information by accessing all secrets across the cluster.
CVE-2026-15218
Primary source · Revision 1
Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.
Security context
Source reference: cve:CVE-2026-15218
Red Hat OpenShift AI 3.4
Source reference: /containers/cna/affected/2/product
- Affected versions
- Not stated in this record
- Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
Red Hat OpenShift AI 3.4
Source reference: /containers/cna/affected/3/product
- Affected versions
- Not stated in this record
- Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
Structured affected-version data
Original package identities and version rules from this source.
[
{
"versions": [
{
"status": "affected",
"changes": [
{
"at": "d7099eabc2c52bb5328cb7a9dd137cc2ea90dd53",
"status": "unaffected"
}
],
"version": "0",
"lessThan": "*",
"versionType": "git"
}
],
"packageName": "maas-api",
"collectionURL": "https://github.com/opendatahub-io/models-as-a-service",
"defaultStatus": "unknown"
},
{
"versions": [
{
"status": "affected",
"version": "0",
"lessThan": "*",
"versionType": "semver"
}
],
"packageName": "maas-controller",
"collectionURL": "https://github.com/opendatahub-io/models-as-a-service",
"defaultStatus": "unaffected"
},
{
"cpes": [
"cpe:/a:redhat:openshift_ai:3.4::el9"
],
"vendor": "Red Hat",
"product": "Red Hat OpenShift AI 3.4",
"versions": [
{
"status": "unaffected",
"version": "1787153683",
"lessThan": "*",
"versionType": "rpm"
}
],
"packageName": "rhoai/odh-maas-api-rhel9",
"collectionURL": "https://catalog.redhat.com/software/containers/",
"defaultStatus": "affected"
},
{
"cpes": [
"cpe:/a:redhat:openshift_ai:3.4::el9"
],
"vendor": "Red Hat",
"product": "Red Hat OpenShift AI 3.4",
"versions": [
{
"status": "unaffected",
"version": "1791790095",
"lessThan": "*",
"versionType": "rpm"
}
],
"packageName": "rhoai/odh-maas-controller-rhel9",
"collectionURL": "https://catalog.redhat.com/software/containers/",
"defaultStatus": "affected"
}
]- Related CVEs
- CVE-2026-15218
Source reference:
/cveMetadata/cveId
Publisher severity
high
Source reference: /containers/cna/metrics
- Event
- #38799 · Revision 1
- Added to Heist Feed
- Publisher date