CVE-2024-7557: OpenShift AI: model auth bypass via exposed token

HIGH

Published August 8, 2024

CISO Take

CVE-2024-7557 lets any authenticated user in an OpenShift AI namespace reuse a ServiceAccount token shown in the dashboard UI to reach other models and APIs in that namespace, defeating the per-model authentication option. The CVSS is 8.8 (high), and the attack needs only low privileges, no user interaction and a network path. There is no public exploit, no Nuclei template, no KEV listing and no EPSS score yet, so exploitation pressure looks low. The token carries view privileges, so the main risk is cross-model data exposure and reconnaissance, and multi-tenant namespaces are the most exposed. The affected package has 3,046 downstream dependents, 78 other CVEs and a modest OpenSSF Scorecard of 5.8/10. Apply the Red Hat fix from RHBA-2024:8240, rotate any ServiceAccount tokens that were visible in the UI, and stop sharing namespaces between models of different sensitivity.

Sources:NVDRed Hat Security AdvisoryRed Hat BugzillaGitHub (opendatahub-io/odh-dashboard)OpenSSFATLAS

What is the risk?

High severity, moderate real-world risk. Exploitation is trivial for anyone with a low-privilege account in the namespace: copy the visible token and use it with oc --token. There is no public exploit or KEV listing, and EPSS is unavailable. Impact is high confidentiality exposure across models in the same namespace, with possible integrity and availability effects depending on the RBAC bound to the ServiceAccount. Exposure is greatest in shared, multi-team or multi-tenant OpenShift AI clusters. Single-tenant namespaces face lower risk.

How does the attack unfold?

Initial Access

The attacker holds a low-privilege account in a shared OpenShift AI namespace and opens the dashboard.

AML.T0012

Credential Theft

The attacker copies the ServiceAccount token that the UI displays for an auth-protected model.

AML.T0055

Privilege Escalation

The attacker uses oc --token={token} to authenticate with the ServiceAccount's view privileges across the namespace.

AML.T0091.000

Impact

The attacker queries other models' inference APIs and reads namespace resources, exposing model data and configuration.

AML.T0040

Initial Access

The attacker holds a low-privilege account in a shared OpenShift AI namespace and opens the dashboard.

AML.T0012

Credential Theft

The attacker copies the ServiceAccount token that the UI displays for an auth-protected model.

AML.T0055

Privilege Escalation

The attacker uses oc --token={token} to authenticate with the ServiceAccount's view privileges across the namespace.

AML.T0091.000

Impact

The attacker queries other models' inference APIs and reads namespace resources, exposing model data and configuration.

AML.T0040

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
Jupyter Notebook	pip	—	No patch
13.5KOpenSSF 5.83.0K dependentsPushed 11d ago79% patched~75d to patchFull package profile →
Jupyter Notebook	pip	—	No patch
13.5KOpenSSF 5.83.0K dependentsPushed 11d ago79% patched~75d to patchFull package profile →
odh-dashboard	—	—	No patch
rhoai/odh-codeflare-operator-rhel8	—	—	No patch
rhoai/odh-dashboard-rhel8	—	—	No patch
rhoai/odh-data-science-pipelines-argo-argoexec-rhel8	—	—	No patch
rhoai/odh-data-science-pipelines-argo-workflowcontroller-rhel8	—	—	No patch
rhoai/odh-data-science-pipelines-operator-controller-rhel8	—	—	No patch
rhoai/odh-kuberay-operator-controller-rhel8	—	—	No patch
rhoai/odh-kueue-controller-rhel8	—	—	No patch
rhoai/odh-ml-pipelines-api-server-rhel8	—	—	No patch
rhoai/odh-ml-pipelines-api-server-v2-rhel8	—	—	No patch
rhoai/odh-ml-pipelines-artifact-manager-rhel8	—	—	No patch
rhoai/odh-ml-pipelines-cache-rhel8	—	—	No patch
rhoai/odh-ml-pipelines-driver-rhel8	—	—	No patch
rhoai/odh-ml-pipelines-launcher-rhel8	—	—	No patch
rhoai/odh-ml-pipelines-persistenceagent-rhel8	—	—	No patch
rhoai/odh-ml-pipelines-persistenceagent-v2-rhel8	—	—	No patch
rhoai/odh-ml-pipelines-scheduledworkflow-rhel8	—	—	No patch
rhoai/odh-ml-pipelines-scheduledworkflow-v2-rhel8	—	—	No patch
rhoai/odh-mlmd-grpc-server-rhel8	—	—	No patch
rhoai/odh-mm-rest-proxy-rhel8	—	—	No patch
rhoai/odh-model-controller-rhel8	—	—	No patch
rhoai/odh-model-registry-operator-rhel8	—	—	No patch
rhoai/odh-model-registry-rhel8	—	—	No patch
rhoai/odh-modelmesh-rhel8	—	—	No patch
rhoai/odh-modelmesh-runtime-adapter-rhel8	—	—	No patch
rhoai/odh-modelmesh-serving-controller-rhel8	—	—	No patch
rhoai/odh-operator-bundle	—	—	No patch
rhoai/odh-rhel8-operator	—	—	No patch
rhoai/odh-training-operator-rhel8	—	—	No patch
rhoai/odh-trustyai-service-operator-rhel8	—	—	No patch
rhoai/odh-trustyai-service-rhel8	—	—	No patch
rhods/odh-dashboard-rhel8	—	—	No patch
rhods/odh-model-controller-rhel8	—	—	No patch

How severe is it?

CVSS 3.1

8.8 / 10

EPSS

1.0%

chance of exploitation in 30 days

Higher than 62% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

No known exploitation

Sophistication

Trivial

What is the attack surface?

AVNetwork

ACLow

PRLow

UINone

SUnchanged

CHigh

IHigh

AHigh

What should I do?

1 step

1) Update OpenShift AI / Open Data Hub to the release containing the fix (RHBA-2024:8240 and upstream odh-dashboard PR #3198). 2) Rotate or revoke all ServiceAccount tokens that were exposed in the UI and redeploy the protected models. 3) Put models of different sensitivity or ownership in separate namespaces. 4) Reduce the ServiceAccount permissions bound to model-serving accounts and review RoleBindings that grant view access. 5) Detect abuse by auditing Kubernetes API logs for model ServiceAccount tokens used from unexpected IPs or against resources outside their own model. 6) Apply network policies that restrict access to inference endpoints.

How is it classified?

Auth BypassData LeakageFrameworkInferenceAPIAML.T0012- Valid Accounts AML.T0040- AI Model Inference API Access AML.T0055- Unsecured Credentials AML.T0091.000- Application Access Token

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Art. 15-Accuracy, robustness and cybersecurity

ISO 42001

A.6.2.6-AI system operation and monitoring

NIST AI RMF

MANAGE 2.3-Responses to previously unknown risks and mechanisms to disengage or deactivate AI systems

OWASP LLM Top 10

LLM06-Excessive Agency

Frequently Asked Questions

What is CVE-2024-7557?

Is CVE-2024-7557 actively exploited?

No confirmed active exploitation of CVE-2024-7557 has been reported, but organizations should still patch proactively.

How to fix CVE-2024-7557?

1) Update OpenShift AI / Open Data Hub to the release containing the fix (RHBA-2024:8240 and upstream odh-dashboard PR #3198). 2) Rotate or revoke all ServiceAccount tokens that were exposed in the UI and redeploy the protected models. 3) Put models of different sensitivity or ownership in separate namespaces. 4) Reduce the ServiceAccount permissions bound to model-serving accounts and review RoleBindings that grant view access. 5) Detect abuse by auditing Kubernetes API logs for model ServiceAccount tokens used from unexpected IPs or against resources outside their own model. 6) Apply network policies that restrict access to inference endpoints.

What systems are affected by CVE-2024-7557?

This vulnerability affects the following AI/ML architecture patterns: model serving, MLOps platforms, training pipelines, multi-tenant Kubernetes AI platforms, model registries.

What is the CVSS score for CVE-2024-7557?

CVE-2024-7557 has a CVSS v3.1 base score of 8.8 (HIGH). The EPSS exploitation probability is 0.98%.

What is the AI security impact?

Affected AI Architectures

model servingMLOps platformstraining pipelinesmulti-tenant Kubernetes AI platformsmodel registries

MITRE ATLAS Techniques

AML.T0012Valid Accounts

AML.T0040AI Model Inference API Access

AML.T0055Unsecured Credentials

AML.T0091.000Application Access Token

Compliance Controls Affected

EU AI Act: Art. 15

ISO 42001: A.6.2.6

NIST AI RMF: MANAGE 2.3

OWASP LLM Top 10: LLM06

What are the technical details?

Original Advisory

A vulnerability was found in OpenShift AI that allows for authentication bypass and privilege escalation across models within the same namespace. When deploying AI models, the UI provides the option to protect models with authentication. However, credentials from one model can be used to access other models and APIs within the same namespace. The exposed ServiceAccount tokens, visible in the UI, can be utilized with oc --token={token} to exploit the elevated view privileges associated with the ServiceAccount, leading to unauthorized access to additional resources.

Exploitation Scenario

An insider or a compromised data scientist account with access to a shared OpenShift AI project opens the dashboard and copies the authentication token displayed for a low-sensitivity model. The attacker runs oc --token={token} against the cluster and finds the ServiceAccount's view privileges extend across the namespace. They list other model deployments, read their configuration and endpoints, and call the protected inference APIs of a proprietary model. They can then exfiltrate model metadata, pipeline definitions and connection details, or extract the model through repeated queries.

Weaknesses (CWE)

CWE-305Authentication Bypass by Primary Weakness

CWE-305 — Authentication Bypass by Primary Weakness: The authentication algorithm is sound, but the implemented mechanism can be bypassed as the result of a separate weakness that is primary to the authentication error.

Source: MITRE CWE corpus.