CVE-2026-15218

Published: Ago 17, 2026 Last Modified: Ago 17, 2026
ExploitDB:
Other exploit source:
Google Dorks:
HIGH 7,9
Source: [email protected]
Attack Vector: network
Attack Complexity: high
Privileges Required: high
User Interaction: none
Scope: changed
Confidentiality: high
Integrity: high
Availability: low

Description

AI Translation Available

A flaw was found in the maas-api and maas-controller ServiceAccounts within Red Hat OpenShift AI. These ServiceAccounts are granted cluster-wide permissions that exceed their operational requirements. An attacker who compromises the identity of these ServiceAccounts, either through a remote code execution vulnerability or by creating a malicious pod in the same namespace, could exploit these excessive permissions. This could lead to full cluster administrator privileges through the creation of new ClusterRoleBindings or the disclosure of sensitive information by accessing all secrets across the cluster.

266

Incorrect Privilege Assignment

Draft
Abstraction: Base Structure: Simple
Common Consequences
Security Scopes Affected:
Access Control
Potential Impacts:
Gain Privileges Or Assume Identity
Applicable Platforms
All platforms may be affected
View CWE Details
https://access.redhat.com/security/cve/CVE-2026-15218
https://access.redhat.com/security/cve/CVE-2026-15218
https://bugzilla.redhat.com/show_bug.cgi?id=2498426
https://bugzilla.redhat.com/show_bug.cgi?id=2498426