Critical Flaw in Red Hat OpenShift AI ServiceAccounts Exposes Cluster Risks
Article Content
- •CVE-2026-15218 affects Red Hat OpenShift AI's maas-api and maas-controller ServiceAccounts.
- •Excessive permissions could allow attackers to escalate privileges to cluster-admin.
- •The vulnerability was published on August 17, 2026, and is currently under review.
A vulnerability identified as CVE-2026-15218 affects the maas-api and maas-controller ServiceAccounts in Red Hat OpenShift AI. These accounts possess excessive cluster-wide permissions, which could be exploited by an attacker who compromises their identity. The attack vector includes remote code execution or the creation of malicious pods within the same namespace. Successful exploitation could grant full cluster administrator privileges or lead to unauthorized access to sensitive information across the cluster. The flaw is classified as moderate, with the potential for significant impact if exploited. Red Hat has published preliminary CVSS scores, indicating the severity of the issue. The vulnerability was published on August 17, 2026, and remains under review for further assessment. Security teams are advised to monitor their environments for signs of exploitation.
Ask AI about this cluster
Answers cite the sources they use
Timeline
More articles in this cluster (3)
Following this threat?
Track CVE-2026-15218 in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.
Free account · no card needed
Continue Reading
Critical BeyondTrust 9.3 Vulnerability Actively Exploited by Threat Actor A critical vulnerability (CVE-2026-102764) in BeyondTrust Remote Support has been discovered and is actively being exploited by the threat group ARMORY CASTLE, reportedly linked to China. The vulnerability, which has a CVSS score of 9.3, allows unauthenticated attackers to upload files and potentially compromise host… 
Lazarus APT Launches Operation FlashHole Using AI and Post-Quantum Cryptography Kaspersky has identified a cyberespionage campaign, dubbed Operation FlashHole, attributed to the Lazarus APT group, active since July 2025. The campaign has targeted at least three organizations in South Korea's construction, software, and wire-communication sectors. Attack methods include spear-phishing emails…