CVE 2026 15218

access.redhat.com • August 18, 2026

A flaw was found in the maas-api and maas-controller ServiceAccounts within Red Hat OpenShift AI. These ServiceAccounts are granted cluster-wide permissions that exceed their operational requirements. An attacker who compromises the identity of these ServiceAccounts, either through a remote code execution vulnerability or by creating a malicious pod in the same namespace, could exploit these excessive permissions. This could lead to full cluster administrator privileges through the creation of new ClusterRoleBindings or the disclosure of sensitive information by accessing all secrets across the cluster.

Moderate: Red Hat OpenShift AI is impacted by overly permissive RBAC configurations for the maas-api and maas-controller ServiceAccounts. Although exploitation necessitates a prior compromise of a pod or the ability to create pods in the respective namespaces, a successful attack could result in privilege escalation to cluster-admin or the unauthorized exfiltration of cluster-wide secrets.

CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications ).

The following CVSS metrics and score provided are preliminary and subject to review.

Red Hat: CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:L

cve.org: CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:L

Technical Impact: Gain Privileges or Assume Identity

A user can access restricted functionality and/or sensitive information that may include administrative functionality and user accounts.

Not sure what something means? Check out our Security Glossary .

For clarification or corrections, please Red Hat Product Security .

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Critical Flaw in Red Hat OpenShift AI ServiceAccounts Exposes Cluster Risks A vulnerability identified as CVE-2026-15218 affects the maas-api and maas-controller ServiceAccounts in Red Hat OpenShift AI. These accounts possess excessive cluster-wide permissions, which could be exploited by an attacker who compromises their identity. The attack vector includes remote code execution or the creation of malicious pods within the same namespace. Successful exploitation could grant full cluster administrator privileges or lead to unauthorized access to sensitive information across the cluster. The flaw is classified as moderate, with the potential for significant impact if exploited. Red Hat has published preliminary CVSS scores, indicating the severity of the issue. The vulnerability was published on August 17, 2026, and remains under review for further assessment. Security teams are advised to monitor their environments for signs of exploitation. 2 sources 55

Extracted Entities

CVE 2026 15218

The full story

Extracted Entities

Attack Types (1)

CWE Weaknesses (2)

Domains (1)

MITRE ATT&CK (2)

Platforms (1)