CVE-2026-14450

Name of the Vulnerable Software and Affected Versions MaaS API (affected versions not specified)

Description A flaw in the MaaS API allows any pod within the cluster to bypass the Kuadrant AuthPolicy gateway. This occurs because the system trusts the X-MaaS-Username and X-MaaS-Group HTTP headers verbatim without first-party authentication. An attacker can forge these headers to gain unauthorized access and escalate privileges, enabling them to mint Kubernetes ServiceAccount tokens in namespaces belonging to other tenants, revoke API keys, and exfiltrate sensitive model access configuration.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.