CVE-2024-7557

CVE-2024-7557 is a high-severity authentication bypass and privilege escalation vulnerability affecting Red Hat OpenShift AI and OpenShift Data Science. It allows an authenticated attacker to use credentials from one AI model to access other models and APIs within the same namespace, even if those models are configured for authentication. This can lead to unauthorized access to additional resources by exploiting exposed ServiceAccount tokens visible in the UI. The vulnerability has a CVSS score of 8.8 (High), indicating a network-based attack with low complexity, requiring low privileges, and resulting in high impact to confidentiality, integrity, and availability. While the EPSS score is low, suggesting a low likelihood of exploitation in the wild, the FAUCET Risk Score is 67/100. Currently, there is no evidence of active exploitation, and no public exploit code (Metasploit, Nuclei, ExploitDB) is available. The vulnerability has also received no community discussion or media coverage, which is typical for the majority of CVEs.