Authentication Bypass in MaaS API via Header Forgery

A critical authentication vulnerability (CVE-2026-14450) exists in the MaaS API, where the service implicitly trusts specific HTTP headers for identity verification. By forging the 'X-MaaS-Username' and 'X-MaaS-Group' headers, any pod deployed within the same Kubernetes cluster can circumvent the Kuadrant AuthPolicy gateway. This bypass renders the platform's multi-tenancy controls ineffective, as the API accepts the provided claims without secondary validation or cryptographic proof. An attacker within the cluster environment can impersonate administrative users or other tenants, leading to unauthorized API interactions. This is particularly dangerous in multi-tenant environments where shared infrastructure relies on these specific headers to partition resources and enforce authorization.

Impact

Successful exploitation allows for full tenant impersonation within the cluster. Concrete impact includes the unauthorized minting of Kubernetes ServiceAccount tokens in foreign namespaces, the ability to revoke legitimate API keys, and the exfiltration of sensitive model access configurations and tenant secrets. Given the CVSS score of 9.9, this vulnerability permits complete control over the affected MaaS API instances.

Recommendation

• Immediately review ingress and gateway configurations to ensure that 'X-MaaS-Username' and 'X-MaaS-Group' headers are stripped or validated at the network perimeter before reaching the MaaS API backend.
• Implement strict mTLS and network policies to isolate pods and limit their ability to communicate directly with the MaaS API unless explicitly authorized.
• Monitor service mesh or API gateway logs for unexpected HTTP requests containing non-standard or administrative values in the 'X-MaaS' header set.