EUVD-2025-209086
GHSA-cq3g-qvxc-ghr5
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A06:2025 - Insecure Design
ASVS 5.0
V15 - Secure Coding and Architecture Component isolation
|
| Impact | Real-world risk is elevated for multi-tenant OpenShift AI deployments. The CVSS vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N indicates network-accessible exploitation with low complexity requiring only low-privileged authenticated access, yielding high confidentiality and integrity impact. Attack complexity is genuinely low because any authenticated user with pod creation rights in their namespace can craft network requests to enumerate and access services in adjacent namespaces using predictable Kubernetes DNS naming conventions. No public exploit identified at time of analysis and no EPSS data provided, but the technical barrier is minimal for insiders or attackers who have compromised limited tenant credentials. The confined scope (S:U) limits impact to data within the vulnerable component rather than broader cluster compromise. This is a priority fix for organizations running RHOAI in shared environments with untrusted tenants, though lower risk for single-tenant or air-gapped installations where namespace boundaries are less critical. Red Hat has issued RHSA-2026:2106 and RHSA-2026:2695 advisories, indicating vendor acknowledgment and patch availability. |
| Exploit ScenarioDerived | An attacker with authenticated low-privilege access to an OpenShift AI cluster (for example, a compromised developer account with rights to deploy workloads in their assigned namespace) deploys a pod that enumerates service DNS names across namespaces using predictable naming patterns like llama-stack.target-namespace.svc.cluster.local. The attacker's pod issues HTTP requests directly to discovered Llama Stack endpoints in other users' namespaces, bypassing intended tenant isolation to exfiltrate model inference data, inject malicious prompts, or retrieve sensitive API responses that should remain isolated to the legitimate namespace owner. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Mar 26, 2026
Red Hat OpenShift AI llama-stack-operator permits unauthorized cross-namespace access to Llama Stack service endpoints due to missing NetworkPolicy enforcement, enabling authenticated users in one namespace to view or modify sensitive data in another user's Llama Stack instances. CVSS 8.1 (High) reflects high confidentiality and integrity impact with low-privilege authenticated network access. No public exploit identified at time of analysis, though the authentication bypass weakness (CWE-653) is architecturally straightforward to leverage once cluster access is obtained.
RemediationAI
Apply security updates referenced in Red Hat Security Advisories RHSA-2026:2106 (https://access.redhat.com/errata/RHSA-2026:2106) and RHSA-2026:2695 (https://access.redhat.com/errata/RHSA-2026:2695) to deploy patched versions of the llama-stack-operator that implement proper NetworkPolicy configurations. Consult the vendor advisories for specific package versions and installation procedures. As an interim mitigation until patching is completed, manually define and apply Kubernetes NetworkPolicy resources to restrict ingress traffic to llama-stack service endpoints, permitting connections only from pods within the same namespace and explicitly denying cross-namespace access. Review namespace RBAC policies to limit pod creation privileges to trusted users only, reducing the attacker surface for exploiting this isolation failure.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerability resides in Red Hat OpenShift AI llama-stack-operator, which orchestrates Llama Stack inference services across Kubernetes namespaces. Affected products include Red Hat OpenShift AI 2.25 and RHOAI (cpe:2.3:a:red_hat:red_hat_openshift_ai_2.25 and cpe:2.3:a:red_hat:red_hat_openshift_ai_(rhoai)). The root cause is CWE-653 (Insufficient Compartmentalization), where the operator deploys llama-stack service endpoints without implementing Kubernetes NetworkPolicy resources to enforce namespace isolation. In multi-tenant Kubernetes environments, network traffic is unrestricted by default between pods across namespaces unless explicitly denied via NetworkPolicy. This architectural gap allows direct TCP/HTTP requests from pods in one namespace to service endpoints in another, bypassing logical tenant boundaries that users expect OpenShift's namespace model to provide.
Know when Red Hat Openshift Ai Rhoai gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
2DescriptionCVE.org
A flaw was found in Red Hat OpenShift AI (RHOAI) llama-stack-operator. This vulnerability allows unauthorized access to Llama Stack services deployed in other namespaces via direct network requests, because no NetworkPolicy restricts access to the llama-stack service endpoint. As a result, a user in one namespace can access another user’s Llama Stack instance and potentially view or manipulate sensitive data.
Executive ViewAI
Red Hat OpenShift AI deployments using llama-stack-operator are vulnerable to cross-namespace data access by authenticated cluster users, creating a multi-tenancy isolation failure that exposes sensitive AI model data and configurations across organizational boundaries. Organizations running OpenShift AI in shared cluster environments face confidentiality and integrity risks until network isolation controls are enforced, as users in one namespace can view or modify Llama Stack instances belonging to other teams or customers.
Implement Kubernetes NetworkPolicy objects to enforce network segmentation and deny all inter-namespace ingress traffic to Llama Stack service ports; restrict llama-stack-operator service account permissions using RBAC to limit cross-namespace resource access; isolate sensitive Llama Stack workloads to dedicated namespace clusters; enable audit logging on all Kubernetes API calls to detect cross-namespace access attempts. No vendor-released patch identified at time of analysis-compensating controls are mandatory until patch availability is confirmed.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
More in Red Hat Openshift Ai Rhoai
View allThe Feast Feature Server contains a path traversal vulnerability in its `/read-document` endpoint that allows unauthenti
Unauthenticated remote code execution affects Feast (the open-source ML feature store), where user-defined functions sto
Authentication bypass in the Models-as-a-Service (MaaS) API component of Red Hat OpenShift AI (RHOAI) lets any pod alrea
Kubernetes Service Account token disclosure in the odh-dashboard component of Red Hat OpenShift AI (RHOAI) lets an authe
Server-side request forgery in the file_type content detector of guardrails-detectors (a component shipped with Red Hat
Arbitrary file write in the Feast Feature Server's `/save-document` endpoint lets an unauthenticated remote attacker wri
Privilege escalation in Red Hat OpenShift AI (RHOAI) training operator overlay allows any namespace editor to manage Tra
Privilege escalation in Red Hat OpenShift AI's training-operator enables any user holding a standard Kubernetes edit or
MySQL DSN parameter injection in Red Hat OpenShift AI's Data Science Pipelines Operator (DSPO) allows a namespace editor
Privilege escalation in odh-dashboard, the web interface for Red Hat OpenShift AI (RHOAI), allows any authenticated dash
Privilege escalation in odh-dashboard (Red Hat OpenShift AI) allows an attacker who has obtained the dashboard's Service
The MaaS (Model-as-a-Service) Gateway component in Red Hat OpenShift AI (RHOAI) is improperly configured, enabling any l
Exploit-DB