134 matches found
Critical: Red Hat Security Advisory: RHOAI 2.25.12 - Red Hat OpenShift AI
Updated images are now available for Red Hat OpenShift AI. Release of RHOAI 2.25.12 provides these changes:...
Critical: Red Hat Security Advisory: RHOAI 3.5.2 - Red Hat OpenShift AI
Updated images are now available for Red Hat OpenShift AI. Release of RHOAI 3.5.2 provides these changes:...
CVE-2026-17557
A flaw was found in the lm-evaluation-harness component of Red Hat OpenShift AI. An authenticated user, able to submit an evaluation job, could exploit this by providing a malicious model URL in the JobSpec. This vulnerability allows for the disclosure of the tenant's model authentication secret ...
CVE-2026-17557 Lm-evaluation-harness: lm-evaluation-harness: ssrf via job-spec model.url with bearer credential forwarding
A flaw was found in the lm-evaluation-harness component of Red Hat OpenShift AI. An authenticated user, able to submit an evaluation job, could exploit this by providing a malicious model URL in the JobSpec. This vulnerability allows for the disclosure of the tenant's model authentication secret ...
CVE-2026-17557
A vulnerability exists in the lm-evaluation-harness component of Red Hat OpenShift AI . An authenticated user capable of submitting evaluation jobs can exploit this by providing a malicious model URL in the JobSpec . This flaw allows for the disclosure of the tenant's model authentication secret ...
EUVD-2026-107135
A flaw was found in the lm-evaluation-harness component of Red Hat OpenShift AI. An authenticated user, able to submit an evaluation job, could exploit this by providing a malicious model URL in the JobSpec. This vulnerability allows for the disclosure of the tenant's model authentication secret ...
CVE-2026-17557
A flaw was found in the lm-evaluation-harness component of Red Hat OpenShift AI. An authenticated user, able to submit an evaluation job, could exploit this by providing a malicious model URL in the JobSpec. This vulnerability allows for the disclosure of the tenant's model authentication secret ...
PT-2026-120495
A flaw was found in the lm-evaluation-harness component of Red Hat OpenShift AI. An authenticated user, able to submit an evaluation job, could exploit this by providing a malicious model URL in the JobSpec. This vulnerability allows for the disclosure of the tenant's model authentication secret ...
Critical: Red Hat Security Advisory: RHOAI 3.4.5 - Red Hat OpenShift AI
Updated images are now available for Red Hat OpenShift AI. Release of RHOAI 3.4.5 provides these changes:...
Critical: Red Hat Security Advisory: RHOAI 3.3.7 - Red Hat OpenShift AI
Updated images are now available for Red Hat OpenShift AI. Release of RHOAI 3.3.7 provides these changes:...
Important: Red Hat Security Advisory: RHOAI 3.5.1 - Red Hat OpenShift AI
Updated images are now available for Red Hat OpenShift AI. Release of RHOAI 3.5.1 provides these changes:...
Important: Red Hat Security Advisory: RHOAI 2.25.11 - Red Hat OpenShift AI
Updated images are now available for Red Hat OpenShift AI. Release of RHOAI 2.25.11 provides these changes:...
CVE-2026-86332
A flaw was found in odh-dashboard in Red Hat OpenShift AI. The backend-for-frontend route GET /api/nim-serving/:nimResource reads Kubernetes Secrets using the dashboard service account and returns the full Secret object, including .data, without an authorization check. Any authenticated dashboard...
CVE-2026-86332
A flaw in the odh-dashboard component of Red Hat OpenShift AI allows any authenticated dashboard user to read Kubernetes Secrets without an authorization check. The backend-for-frontend route GET /api/nim-serving/:nimResource uses the dashboard service account to retrieve and return the full Secr...
CVE-2026-86332 Odh-dashboard: odh-dashboard: nim credential secret readable by any authenticated user
A flaw was found in odh-dashboard in Red Hat OpenShift AI. The backend-for-frontend route GET /api/nim-serving/:nimResource reads Kubernetes Secrets using the dashboard service account and returns the full Secret object, including .data, without an authorization check. Any authenticated dashboard...
EUVD-2026-72304
A flaw was found in odh-dashboard in Red Hat OpenShift AI. The backend-for-frontend route GET /api/nim-serving/:nimResource reads Kubernetes Secrets using the dashboard service account and returns the full Secret object, including .data, without an authorization check. Any authenticated dashboard...
CVE-2026-86332 Odh-dashboard: odh-dashboard: nim credential secret readable by any authenticated user
A flaw was found in odh-dashboard in Red Hat OpenShift AI. The backend-for-frontend route GET /api/nim-serving/:nimResource reads Kubernetes Secrets using the dashboard service account and returns the full Secret object, including .data, without an authorization check. Any authenticated dashboard...
CVE-2026-86332
A flaw was found in odh-dashboard in Red Hat OpenShift AI. The backend-for-frontend route GET /api/nim-serving/:nimResource reads Kubernetes Secrets using the dashboard service account and returns the full Secret object, including .data, without an authorization check. Any authenticated dashboard...
CVE-2026-86332: Missing Authorization
A flaw was found in odh-dashboard in Red Hat OpenShift AI. The backend-for-frontend route GET /api/nim-serving/:nimResource reads Kubernetes Secrets using the dashboard service account and returns the full Secret object, including .data, without an authorization check. Any authenticated dashboard...
PT-2026-86661
A flaw was found in odh-dashboard in Red Hat OpenShift AI. The backend-for-frontend route GET /api/nim-serving/:nimResource reads Kubernetes Secrets using the dashboard service account and returns the full Secret object, including .data, without an authorization check. Any authenticated dashboard...