by Kastro
Paper/Archive/CVE-2026-14450

CVE-2026-14450

Red Hat Red Hat OpenShift AI 3.4 — Maas-billing: maas api: privilege escalation via forged http headers due to missing authentication

EPSS 0.7%CVSS 9.9
critical.is priorityof 100
40
CVSS 9.9 (CNA)9.9 / 10 × 3029.7Not in CISA KEV+300.0EPSS percentile 52.8.528 × 2010.6No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

A flaw was found in the MaaS API. This vulnerability allows any pod within the cluster to bypass the Kuadrant AuthPolicy gateway by forging HTTP headers, specifically `X-MaaS-Username` and `X-MaaS-Group`, which are trusted verbatim. This lack of first-party authentication enables an attacker to gain unauthorized access and escalate privileges. The concrete consequences include the ability to mint Kubernetes ServiceAccount tokens in other tenants' namespaces, revoke API keys, and exfiltrate sensitive model access configuration.

Affected

ProductAffectedFixed inSource
Red Hat OpenShift AI 3.4see advisory1785850409CNA
Red Hat OpenShift AI 3.4see advisory1787153683CNA
Red Hat OpenShift AI (RHOAI)see advisory–CNA
Red Hat OpenShift AI (RHOAI)see advisory–CNA

Scores by source

redhat (CNA)9.9CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
CISA ADPSSVCExploitation: none · Automatable: no · Technical impact: total

References

advisoryaccess.redhat.com/errata/RHSA-2026:53262advisoryaccess.redhat.com/errata/RHSA-2026:60520refaccess.redhat.com/security/cve/CVE-2026-14450refbugzilla.redhat.com/show_bug.cgi?id=2496373