CVE-2026-16456

Name of the Vulnerable Software and Affected Versions odh-model-controller (affected versions not specified)

Description An authenticated user with permissions to create custom resources can exploit a flaw in the loadSecret() function. The function improperly reads the Secret namespace from user-controlled input without validation, allowing an attacker to read sensitive API keys and cloud credentials from other namespaces, resulting in information disclosure.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.