VulnSocial

CVE-2026-14450Patch

LOWCVSS 9.9 · CRITICAL

Signal is active with 1 mentions in latest observed window

Immediate actions

  • Patch affected systems immediately

Recommended action window: Monitor and triage in normal cycle

NVD description

A flaw was found in the MaaS API. This vulnerability allows any pod within the cluster to bypass the Kuadrant AuthPolicy gateway by forging HTTP headers, specifically `X-MaaS-Username` and `X-MaaS-Group`, which are trusted verbatim. This lack of first-party authentication enables an attacker to gain unauthorized access and escalate privileges. The concrete consequences include the ability to mint Kubernetes ServiceAccount tokens in other tenants' namespaces, revoke API keys, and exfiltrate sensitive model access configuration.

Back to dashboard
0.5/ 10 priority

Sources & remediation

Other references
Weakness type (CWE)
CWE-290

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

AVAILABLE

Momentum

NONE

Threat summary

  • Patch or workaround signal is available
  • 1 mentions across 1 observed day

What's happening

  • Patch or workaround mentioned in 1 signal
  • Technical details provided in 1 signal
  • 1 total mentions across 1 day

Deep dive

Activity timeline1 mentions / 1d
00111Mentions · 2026-08-11: 1Patch / Workaround · 2026-08-11: 1Technical Details · 2026-08-11: 108-11
Signal classification1 categories
Patch
1100.0%
Referenced assets1 URL
Full discourse1 post
  • ThreatAft@ThreatAft
    Patch

    🚨 Red Hat OpenShift AI August Patch Day — 17 CVEs CVE-2026-18948 (9.9): Feast deserialization RCE CVE-2026-14450 (9.9): MaaS API privilege escalation → http://threataft.com/articles/red-hat-openshift-ai-august-2026-patch-day-17-cves #cybersecurity #infosec #RHOAI #OpenShift #PatchTuesday #ThreatIntel

    Post summary

    Red Hat OpenShift AI released a patch day for 17 CVEs, including two high‑severity CVEs (CVE‑2026‑18948 and CVE‑2026‑14450) involving deserialization RCE and API privilege escalation, with a link to an article detailing the fixes.

    0000045
    36 followersView on X

Explore more

Back to dashboard