40 matches found
Critical: Red Hat Security Advisory: RHOAI 2.25.12 - Red Hat OpenShift AI
Updated images are now available for Red Hat OpenShift AI. Release of RHOAI 2.25.12 provides these changes:...
Critical: Red Hat Security Advisory: RHOAI 3.5.2 - Red Hat OpenShift AI
Updated images are now available for Red Hat OpenShift AI. Release of RHOAI 3.5.2 provides these changes:...
CVE-2026-17557
A flaw was found in the lm-evaluation-harness component of Red Hat OpenShift AI. An authenticated user, able to submit an evaluation job, could exploit this by providing a malicious model URL in the JobSpec. This vulnerability allows for the disclosure of the tenant's model authentication secret ...
CVE-2026-17557
A vulnerability exists in the lm-evaluation-harness component of Red Hat OpenShift AI . An authenticated user capable of submitting evaluation jobs can exploit this by providing a malicious model URL in the JobSpec . This flaw allows for the disclosure of the tenant's model authentication secret ...
EUVD-2026-107135
A flaw was found in the lm-evaluation-harness component of Red Hat OpenShift AI. An authenticated user, able to submit an evaluation job, could exploit this by providing a malicious model URL in the JobSpec. This vulnerability allows for the disclosure of the tenant's model authentication secret ...
CVE-2026-17557 Lm-evaluation-harness: lm-evaluation-harness: ssrf via job-spec model.url with bearer credential forwarding
A flaw was found in the lm-evaluation-harness component of Red Hat OpenShift AI. An authenticated user, able to submit an evaluation job, could exploit this by providing a malicious model URL in the JobSpec. This vulnerability allows for the disclosure of the tenant's model authentication secret ...
CVE-2026-17557
A flaw was found in the lm-evaluation-harness component of Red Hat OpenShift AI. An authenticated user, able to submit an evaluation job, could exploit this by providing a malicious model URL in the JobSpec. This vulnerability allows for the disclosure of the tenant's model authentication secret ...
PT-2026-120495
A flaw was found in the lm-evaluation-harness component of Red Hat OpenShift AI. An authenticated user, able to submit an evaluation job, could exploit this by providing a malicious model URL in the JobSpec. This vulnerability allows for the disclosure of the tenant's model authentication secret ...
Critical: Red Hat Security Advisory: RHOAI 3.4.5 - Red Hat OpenShift AI
Updated images are now available for Red Hat OpenShift AI. Release of RHOAI 3.4.5 provides these changes:...
Critical: Red Hat Security Advisory: RHOAI 3.3.7 - Red Hat OpenShift AI
Updated images are now available for Red Hat OpenShift AI. Release of RHOAI 3.3.7 provides these changes:...
Important: Red Hat Security Advisory: RHOAI 3.5.1 - Red Hat OpenShift AI
Updated images are now available for Red Hat OpenShift AI. Release of RHOAI 3.5.1 provides these changes:...
CVE-2026-86332: Missing Authorization
A flaw was found in odh-dashboard in Red Hat OpenShift AI. The backend-for-frontend route GET /api/nim-serving/:nimResource reads Kubernetes Secrets using the dashboard service account and returns the full Secret object, including .data, without an authorization check. Any authenticated dashboard...
Critical: Red Hat Security Advisory: RHOAI 3.5 - Red Hat OpenShift AI
Updated images are now available for Red Hat OpenShift AI. Release of RHOAI 3.5 provides these changes:...
CVE-2026-15218 Models-as-a-service: red hat openshift ai: maas-api and maas-controller serviceaccounts with excessive permissions lead to privilege escalation
A flaw was found in the maas-api and maas-controller ServiceAccounts within Red Hat OpenShift AI. These ServiceAccounts are granted cluster-wide permissions that exceed their operational requirements. An attacker who compromises the identity of these ServiceAccounts, either through a remote code...
EUVD-2026-60199
A flaw was found in the maas-api and maas-controller ServiceAccounts within Red Hat OpenShift AI. These ServiceAccounts are granted cluster-wide permissions that exceed their operational requirements. An attacker who compromises the identity of these ServiceAccounts, either through a remote code...
CVE-2026-15218 Models-as-a-service: red hat openshift ai: maas-api and maas-controller serviceaccounts with excessive permissions lead to privilege escalation
A flaw was found in the maas-api and maas-controller ServiceAccounts within Red Hat OpenShift AI. These ServiceAccounts are granted cluster-wide permissions that exceed their operational requirements. An attacker who compromises the identity of these ServiceAccounts, either through a remote code...
CVE-2026-15218 Models-as-a-service: red hat openshift ai: maas-api and maas-controller serviceaccounts with excessive permissions lead to privilege escalation
A flaw was found in the maas-api and maas-controller ServiceAccounts within Red Hat OpenShift AI. These ServiceAccounts are granted cluster-wide permissions that exceed their operational requirements. An attacker who compromises the identity of these ServiceAccounts, either through a remote code...
CVE-2026-15218: Incorrect Privilege Assignment
A flaw was found in the maas-api and maas-controller ServiceAccounts within Red Hat OpenShift AI. These ServiceAccounts are granted cluster-wide permissions that exceed their operational requirements. An attacker who compromises the identity of these ServiceAccounts, either through a remote code...