127 matches found
CVE-2026-18951: Privilege Defined With Unsafe Actions
A flaw was found in the Red Hat OpenShift AI RHOAI overlay for the training operator. The RHOAI overlay incorrectly aggregates trainjobs management permissions into the native Kubernetes edit ClusterRole. This allows any user with edit ClusterRole permissions in a namespace to create, modify, and...
CVE-2026-16745
A flaw was found in odh-dashboard, the web console component of Red Hat OpenShift AI RHOAI. Due to incorrect network binding, a malicious actor within the cluster can bypass authentication and impersonate any user by providing an arbitrary access token. This allows an attacker to gain unauthorize...
EUVD-2026-47972
A flaw was found in odh-dashboard, the web console component of Red Hat OpenShift AI RHOAI. Due to incorrect network binding, a malicious actor within the cluster can bypass authentication and impersonate any user by providing an arbitrary access token. This allows an attacker to gain unauthorize...
CVE-2026-16745
A flaw was found in odh-dashboard, the web console component of Red Hat OpenShift AI RHOAI. Due to incorrect network binding, a malicious actor within the cluster can bypass authentication and impersonate any user by providing an arbitrary access token. This allows an attacker to gain unauthorize...
CVE-2026-16745: Origin Validation Error
A flaw was found in odh-dashboard, the web console component of Red Hat OpenShift AI RHOAI. Due to incorrect network binding, a malicious actor within the cluster can bypass authentication and impersonate any user by providing an arbitrary access token. This allows an attacker to gain unauthorize...
CVE-2026-12484
A flaw was found in Keras, specifically within the keras.layers.TorchModuleWrapper.fromconfig method. This vulnerability allows an attacker to perform unsafe deserialization of PyTorch pickle data. By processing untrusted Keras layer configurations, a local attacker could exploit this flaw, leadi...
CVE-2026-15154
A flaw was found in guardrails-detectors, a component of Red Hat OpenShift AI. This vulnerability, known as Regular Expression Denial of Service ReDoS, allows a remote attacker to provide specially crafted regular expressions to the public detection API. This can cause catastrophic backtracking,...
CVE-2026-15154 Guardrails-detectors: guardrails-detectors: unauthenticated regular-expression denial of service (redos) via detector_params.regex
A flaw was found in guardrails-detectors, a component of Red Hat OpenShift AI. This vulnerability, known as Regular Expression Denial of Service ReDoS, allows a remote attacker to provide specially crafted regular expressions to the public detection API. This can cause catastrophic backtracking,...
CVE-2026-15154
Technical details (affected products/versions, root cause specifics, remediation) are not publicly provided in the supplied documents. Monitor for updates to confirm scope, impact and fixes for CVE-2026-15154 regarding guardrails-detectors in Red Hat OpenShift AI.
CVE-2026-12479
A flaw was found in Keras, specifically in the model saving and loading library. This path traversal vulnerability occurs due to improper handling of user-provided layer names, which allows an attacker to craft a malicious Keras model. When this model is saved or loaded, it can escape its intende...
CVE-2026-15154: Inefficient Regular Expression Complexity
A flaw was found in guardrails-detectors, a component of Red Hat OpenShift AI. This vulnerability, known as Regular Expression Denial of Service ReDoS, allows a remote attacker to provide specially crafted regular expressions to the public detection API. This can cause catastrophic backtracking,...
PT-2026-56557
Name of the Vulnerable Software and Affected Versions Red Hat OpenShift AI affected versions not specified Description A Regular Expression Denial of Service ReDoS flaw exists in the guardrails-detectors component. A remote attacker can send specially crafted regular expressions to the public...
Authorization Bypass Through User-Controlled Key
Overview Affected versions of this package are vulnerable to Authorization Bypass Through User-Controlled Key in the Experiment-scoped Label Schema CRUD API due to missing authorization checks. An attacker can gain unauthorized access or manipulate data by sending crafted requests to the affected...
Authorization Bypass Through User-Controlled Key
Overview mlflow is a platform to streamline machine learning development, including tracking experiments, packaging code into reproducible runs, and sharing and deploying models. Affected versions of this package are vulnerable to Authorization Bypass Through User-Controlled Key in the...
Important: Red Hat Security Advisory: RHOAI 3.3.4 - Red Hat OpenShift AI
Updated images are now available for Red Hat OpenShift AI. Release of RHOAI 3.3.4 provides these changes:...
Important: Red Hat Security Advisory: RHOAI 2.25.8 - Red Hat OpenShift AI
Updated images are now available for Red Hat OpenShift AI. Release of RHOAI 2.25.8 provides these changes:...
Important: Red Hat Security Advisory: RHOAI 3.4.1 - Red Hat OpenShift AI
Updated images are now available for Red Hat OpenShift AI. Release of RHOAI 3.4.1 provides these changes:...
OpenShift AI Insufficient Spatial Partitioning
The vulnerability of the OpenShift AI platform for developing artificial intelligence models is related to insufficient spatial partitioning. Exploiting this vulnerability could allow a malicious actor to compromise the confidentiality and integrity of the protected information...