CVE-2026-13717 Rhoai maas: llm-d: maas/llm-d inference gateway: default allowedroutes.namespaces.from: all allows namespace users to hijack shared model-serving traffic (tokens, prompts, outputs)

[
  {
    "versions": [
      {
        "status": "affected",
        "version": "0",
        "lessThan": "*",
        "versionType": "semver"
      }
    ],
    "packageName": "llm-d",
    "collectionURL": "https://github.com/llm-d/llm-d",
    "defaultStatus": "unaffected"
  },
  {
    "vendor": "Red Hat",
    "product": "Red Hat OpenShift AI 3.4",
    "collectionURL": "https://catalog.redhat.com/software/containers/",
    "packageName": "rhoai/odh-rhel9-operator",
    "defaultStatus": "affected",
    "versions": [
      {
        "version": "1786123541",
        "lessThan": "*",
        "versionType": "rpm",
        "status": "unaffected"
      }
    ],
    "cpes": [
      "cpe:/a:redhat:openshift_ai:3.4::el9"
    ]
  },
  {
    "vendor": "Red Hat",
    "product": "Red Hat OpenShift AI 3.4",
    "collectionURL": "https://catalog.redhat.com/software/containers/",
    "packageName": "rhoai/odh-maas-controller-rhel9",
    "defaultStatus": "affected",
    "versions": [
      {
        "version": "1787153684",
        "lessThan": "*",
        "versionType": "rpm",
        "status": "unaffected"
      }
    ],
    "cpes": [
      "cpe:/a:redhat:openshift_ai:3.4::el9"
    ]
  },
  {
    "vendor": "Red Hat",
    "product": "Red Hat OpenShift AI (RHOAI)",
    "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
    "packageName": "rhoai/odh-kserve-controller-rhel9",
    "defaultStatus": "affected",
    "cpes": [
      "cpe:/a:redhat:openshift_ai"
    ]
  },
  {
    "vendor": "Red Hat",
    "product": "Red Hat OpenShift AI (RHOAI)",
    "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
    "packageName": "rhoai/odh-kserve-llmisvc-controller-rhel9",
    "defaultStatus": "affected",
    "cpes": [
      "cpe:/a:redhat:openshift_ai"
    ]
  },
  {
    "vendor": "Red Hat",
    "product": "Red Hat OpenShift AI (RHOAI)",
    "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
    "packageName": "rhoai/odh-mod-arch-maas-rhel9",
    "defaultStatus": "affected",
    "cpes": [
      "cpe:/a:redhat:openshift_ai"
    ]
  },
  {
    "vendor": "Red Hat",
    "product": "Red Hat OpenShift AI (RHOAI)",
    "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
    "packageName": "rhoai/odh-model-controller-rhel9",
    "defaultStatus": "affected",
    "cpes": [
      "cpe:/a:redhat:openshift_ai"
    ]
  }
]