CVE-2026-16456: Red Hat Openshift Ai 2.25

Medium severity, CVSS 6.5. EPSS: 0.4% chance of exploitation in the next 30 days.

A flaw was found in the `odh-model-controller`. An authenticated user with permissions to create custom resources can exploit a vulnerability in the `loadSecret` function. This function improperly reads the Secret namespace from user-controlled input without validation. This allows an attacker to read sensitive API keys and cloud credentials from other namespaces, leading to information disclosure.

Affected products

• Red Hat Red Hat Openshift Ai 2.25: before 1785187158 (fixed in 1785187158)
• Red Hat Red Hat Openshift Ai 3.3: before 1785189333 (fixed in 1785189333)
• Red Hat Red Hat Openshift Ai 3.4: before 1784950479 (fixed in 1784950479)

Published 2026-08-10. Last modified 2026-08-14.