What is the CVSS score of CVE-2026-18618?

CVE-2026-18618 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.5%.

Which versions of ml-metadata are affected by CVE-2026-18618?

A denial of service vulnerability in Red Hat OpenShift AI allows in-cluster attackers to crash the ml-metadata service, halting ML pipeline execution and blocking data governance operations.. A patch is available.

How to fix or mitigate CVE-2026-18618?

Within 24 hours: Identify and inventory all Red Hat OpenShift AI deployments containing ml-metadata components and audit current network access controls within affected Kubernetes clusters to understand the blast radius. Within 7 days: Deploy Kubernetes NetworkPolicy rules to restrict pod-to-pod communication to ml-metadata services, enable Pod Security Standards to limit lateral movement, and establish real-time monitoring and alerting on ml-metadata pod restart events as an exploitation indicator. Within 30 days: Monitor Red Hat advisories for CVE-2026-18618 patch release, plan and schedule patching once available, and conduct architectural review of your ml-metadata deployment to maximize network isolation and apply principle of least privilege to cluster access.

ml-metadata CVE-2026-18618

EUVD-2026-55825 HIGH

Allocation of Resources Without Limits or Throttling (CWE-770)

2026-08-10 redhat

GHSA-cr6h-6g58-pq2g

Denial Of Service Red Hat Openshift Ai Rhoai Red Hat

7.5

CVSS 3.1 · Vendor: redhat

Severity by source

Vendor (redhat) PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

vuln.today AI

6.5 MEDIUM

Description limits attack to in-cluster actors, making Adjacent (AV:A) more accurate than Network; gRPC endpoint requires no authentication, so PR:N is retained; impact is availability-only.

3.1 AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

4.0 AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Red Hat

7.5 MEDIUM

qualitative

Primary rating from Vendor (redhat).

CVSS VectorVendor: redhat

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

Analysis Generated

Aug 10, 2026 - 21:30 vuln.today

CVE Published

Aug 10, 2026 - 20:45 nvd

HIGH 7.5

DescriptionCVE.org

A flaw was found in ml-metadata. The statically-linked gRPC stack in ml-metadata is outdated, making it vulnerable to known HTTP/2 denial of service (DoS) issues. An in-cluster attacker, with network access to the MLMD pod, could exploit these vulnerabilities by sending specially crafted HTTP/2 requests. This could lead to a denial of service by crashing the MLMD pod, disrupting all pipeline runs in the affected namespace.

AnalysisAI

Denial of service in ml-metadata (MLMD), a core metadata tracking component of Red Hat OpenShift AI (RHOAI), stems from an outdated statically-linked gRPC stack that retains known HTTP/2 resource exhaustion weaknesses. An in-cluster adversary with network reachability to the MLMD pod can crash it by sending specially crafted HTTP/2 requests, halting all ML pipeline runs within the affected namespace. No public exploit has been identified at time of analysis, and exploitation is constrained to actors already operating inside the Kubernetes cluster.

Technical ContextAI

ml-metadata is an open-source library used by Kubeflow and Red Hat OpenShift AI (RHOAI) to record and query metadata associated with ML pipeline artifacts and executions. The service exposes a gRPC API, and per CPE cpe:2.3:a:red_hat:red_hat_openshift_ai_(rhoai):*:*:*:*:*:*:*:* the vulnerable component is bundled across all assessed RHOAI versions. The root cause (CWE-770, Allocation of Resources Without Limits or Throttling) maps to the class of HTTP/2 attacks - such as CONTINUATION flood, RST stream flood, or header table exhaustion - that were publicly disclosed in 2023-2024 against the gRPC and HTTP/2 stacks. Because the gRPC dependency is statically linked rather than dynamically resolved, upstream patches to the gRPC library do not automatically propagate; the RHOAI/MLMD artifact must be rebuilt and redeployed independently to receive fixes.

RemediationAI

Monitor the Red Hat advisory at https://access.redhat.com/security/cve/CVE-2026-18618 and apply any updated RHOAI or ml-metadata package released by Red Hat once available - no specific fixed version was confirmed in the available reference data at time of analysis. As a compensating control, restrict network access to the MLMD pod using Kubernetes NetworkPolicy to allow only explicitly authorized in-cluster services (e.g., the pipeline controller and UI) to reach the gRPC port; this significantly narrows the in-cluster attack surface without disrupting pipeline functionality. Additionally, consider enabling Kubernetes resource limits and liveness/readiness probes on the MLMD pod so that a crash triggers automatic restart, reducing the effective DoS window. Note that automatic restart mitigates downtime duration but does not prevent repeated exploitation by a persistent attacker; network segmentation is the more durable control.