EUVD-2026-55825
GHSA-cr6h-6g58-pq2g
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Description limits attack to in-cluster actors, making Adjacent (AV:A) more accurate than Network; gRPC endpoint requires no authentication, so PR:N is retained; impact is availability-only.
Primary rating from Vendor (redhat).
CVSS VectorVendor: redhat
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Lifecycle Timeline
2DescriptionCVE.org
A flaw was found in ml-metadata. The statically-linked gRPC stack in ml-metadata is outdated, making it vulnerable to known HTTP/2 denial of service (DoS) issues. An in-cluster attacker, with network access to the MLMD pod, could exploit these vulnerabilities by sending specially crafted HTTP/2 requests. This could lead to a denial of service by crashing the MLMD pod, disrupting all pipeline runs in the affected namespace.
AnalysisAI
Denial of service in ml-metadata (MLMD), a core metadata tracking component of Red Hat OpenShift AI (RHOAI), stems from an outdated statically-linked gRPC stack that retains known HTTP/2 resource exhaustion weaknesses. An in-cluster adversary with network reachability to the MLMD pod can crash it by sending specially crafted HTTP/2 requests, halting all ML pipeline runs within the affected namespace. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires that the attacker already possess network access to the MLMD pod from within the Kubernetes cluster - this is not a publicly internet-exposed attack surface under a standard RHOAI deployment. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The NVD-assigned CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/A:H) produces a score of 7.5, but there is a notable discrepancy between that vector and the vulnerability description: the description explicitly scopes the threat to an 'in-cluster attacker with network access to the MLMD pod,' which implies the service is an internal Kubernetes service not exposed to the public internet. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker who has gained execution access to a pod within the same Kubernetes cluster - for example, via a compromised ML training job or a vulnerable sidecar container - sends a stream of specially crafted HTTP/2 requests (such as a CONTINUATION or RST_STREAM flood) to the MLMD gRPC service endpoint. The outdated gRPC stack fails to bound resource allocation, exhausting memory or CPU within the MLMD pod until it crashes. … |
| Remediation | Monitor the Red Hat advisory at https://access.redhat.com/security/cve/CVE-2026-18618 and apply any updated RHOAI or ml-metadata package released by Red Hat once available - no specific fixed version was confirmed in the available reference data at time of analysis. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: Identify and inventory all Red Hat OpenShift AI deployments containing ml-metadata components and audit current network access controls within affected Kubernetes clusters to understand the blast radius. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Red Hat Openshift Ai Rhoai
View allUnauthenticated remote code execution affects Feast (the open-source ML feature store), where user-defined functions sto
Authentication bypass in the Models-as-a-Service (MaaS) API component of Red Hat OpenShift AI (RHOAI) lets any pod alrea
Kubernetes Service Account token disclosure in the odh-dashboard component of Red Hat OpenShift AI (RHOAI) lets an authe
Server-side request forgery in the file_type content detector of guardrails-detectors (a component shipped with Red Hat
Arbitrary file write in the Feast Feature Server's `/save-document` endpoint lets an unauthenticated remote attacker wri
Privilege escalation in Red Hat OpenShift AI (RHOAI) training operator overlay allows any namespace editor to manage Tra
Privilege escalation in Red Hat OpenShift AI's training-operator enables any user holding a standard Kubernetes edit or
MySQL DSN parameter injection in Red Hat OpenShift AI's Data Science Pipelines Operator (DSPO) allows a namespace editor
Privilege escalation in odh-dashboard, the web interface for Red Hat OpenShift AI (RHOAI), allows any authenticated dash
Privilege escalation in odh-dashboard (Red Hat OpenShift AI) allows an attacker who has obtained the dashboard's Service
The MaaS (Model-as-a-Service) Gateway component in Red Hat OpenShift AI (RHOAI) is improperly configured, enabling any l
Authentication bypass in the odh-dashboard web console of Red Hat OpenShift AI (RHOAI) lets a low-privileged actor alrea
Same technique Denial Of Service
View allVendor StatusVendor
Share
External POC / Exploit Code
Leaving vuln.today