Red Hat Openshift Ai Rhoai

Privilege escalation in Red Hat OpenShift AI's Data Science Pipelines component allows authenticated tenants to bypass authorization controls in the setDefaultServiceAccount function by submitting a crafted CreateRun request that references a more privileged ServiceAccount than they are entitled to use. Successful exploitation enables the tenant's pipeline containers to run with elevated Kubernetes RBAC permissions, resulting in cross-namespace secret disclosure and the ability to execute commands inside other tenants' pods. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis.

Denial of service in ml-metadata (MLMD), a core metadata tracking component of Red Hat OpenShift AI (RHOAI), stems from an outdated statically-linked gRPC stack that retains known HTTP/2 resource exhaustion weaknesses. An in-cluster adversary with network reachability to the MLMD pod can crash it by sending specially crafted HTTP/2 requests, halting all ML pipeline runs within the affected namespace. No public exploit has been identified at time of analysis, and exploitation is constrained to actors already operating inside the Kubernetes cluster.

Credential derivation in Red Hat OpenShift AI's Data Science Pipelines Operator allows unauthenticated remote attackers to predict MariaDB root/user passwords and MinIO access/secret keys by exploiting a cryptographically weak PRNG (CWE-338). Any attacker who can reach the MinIO Route or MariaDB Service over the network can compute valid credentials without prior authentication, then access all pipeline artifacts and metadata stored in the system. No active exploitation is confirmed and no public exploit code has been identified at time of analysis, but the CVSS 7.5 High rating with AV:N and PR:N reflects a no-authentication-barrier condition against exposed services.

Privilege escalation in Red Hat OpenShift AI's training-operator enables any user holding a standard Kubernetes edit or admin role in any cluster namespace to break out of namespace isolation, impersonate service accounts, access the host filesystem, and achieve remote code execution. The root cause is a design flaw: the operator aggregates training job permissions onto native Kubernetes built-in ClusterRoles, and allows unrestricted PodTemplateSpec passthrough - meaning users can submit training jobs containing arbitrary pod configurations such as hostPath mounts or elevated service account tokens. No public exploit code or CISA KEV listing was identified at time of analysis, but the low access complexity and the broad availability of edit/admin roles in typical ML platform deployments make this an urgent remediation priority.

Privilege escalation in Red Hat OpenShift AI (RHOAI) training operator overlay allows any namespace editor to manage TrainJob resources beyond their intended authorization scope. The RHOAI overlay incorrectly injects trainjobs CRUD permissions into the native Kubernetes edit ClusterRole, violating the principle of least privilege. When chained with a companion flaw (TRN-01) that permits arbitrary pod configuration within TrainJobs, a remote attacker holding namespace editor credentials could escalate to arbitrary code execution - no public exploit is identified at time of analysis, and KEV listing has not been confirmed.

Privilege escalation in odh-dashboard, the web interface for Red Hat OpenShift AI (RHOAI), allows any authenticated dashboard user to gain cluster-admin or other highly privileged roles by manipulating the roleRef field when creating RoleBindings. The system performs no server-side validation on the roleRef value supplied through the dashboard, enabling an attacker holding only a standard user account to bind themselves to arbitrary Kubernetes ClusterRoles. No public exploit code has been identified at time of analysis and the vulnerability is not listed in the CISA KEV catalog, but the CVSS 8.8 score and the direct, low-complexity path to cluster-admin access make this a high-priority remediation target for any RHOAI deployment.

Privilege escalation in odh-dashboard (Red Hat OpenShift AI) allows an attacker who has obtained the dashboard's Service Account token to abuse overly broad SA permissions and elevate to cluster-administrator level. Exploitation grants full access to secrets, credentials, and keys across the entire OpenShift cluster, while also breaking multi-tenant isolation between workloads. No public exploit code has been identified at time of analysis, and this CVE is not in CISA KEV, but the CVSS score of 8.8 and cluster-wide blast radius make it a high-priority remediation target for RHOAI deployments.

Unauthenticated remote code execution affects Feast (the open-source ML feature store), where user-defined functions stored in the registry are serialized with Python's 'dill' library and deserialized without validation. In default configurations a remote attacker can store a malicious UDF and achieve unauthenticated code execution on the feature server; an authenticated attacker can bypass authorization during deserialization to run code on the registry server, enabling cross-tenant data access and lateral movement. Rated CVSS 9.9 with a scope change; no public exploit has been identified at time of analysis, and it is not listed in CISA KEV. Feast is bundled in Red Hat OpenShift AI (RHOAI), which is the reporting vendor's affected product.

Authorization bypass in Feast's materialization API endpoints within Red Hat OpenShift AI (RHOAI) permits full re-materialization of all feature views by sending a crafted request that omits the feature_views field, circumventing permission checks. The consequence is a multi-tenant Denial of Service through data corruption and significant resource exhaustion, impacting all tenants sharing the deployment. No public exploit code has been identified at time of analysis, but the bypass mechanism is straightforward - a structural omission in the request body - making independent rediscovery likely for any attacker with API access.

Code injection in the Feast operator within Red Hat OpenShift AI (RHOAI) allows an authenticated, high-privileged tenant to embed malicious code into their feature repository, which an automated operator process then executes under elevated Kubernetes RBAC permissions. Successful exploitation yields credential theft and full cluster administrative control, representing a critical privilege escalation pathway despite the moderate vendor CVSS score of 5.5. No public exploit code has been identified at time of analysis, and this vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.

Feast and feast-operator ship with a default 'no_auth' security configuration, leaving the feature-server, registry-server, and offline-server endpoints completely unauthenticated and accessible to any network-reachable attacker in Red Hat OpenShift AI (RHOAI) deployments. Exploitation enables three distinct high-impact outcomes: remote code execution via injection of a malicious User-Defined Function (UDF) onto the feature-server, denial of service by forcing full re-materialization of all tenant features, and unauthorized read access to cross-tenant feature data. No public exploit code has been identified at time of analysis and CISA KEV status is not confirmed, but the trivial exploitation conditions - no authentication, no interaction, default configuration - make this a realistic priority for any RHOAI operator.

Privilege escalation in Red Hat Data Science Pipelines (DSP) allows an authenticated namespace editor to gain node-root access by submitting a crafted Argo Workflow via the V1 API path. The API server, acting as a confused deputy (CWE-266), creates pods with elevated privileges on the attacker's behalf, effectively breaking out of Kubernetes namespace isolation. Successful exploitation enables arbitrary code execution and full control over the underlying cluster node; no public exploit has been identified at time of analysis, and this is not listed in CISA KEV.

MySQL DSN parameter injection in Red Hat OpenShift AI's Data Science Pipelines Operator (DSPO) allows a namespace editor to enable the MySQL LOCAL INFILE feature via the unvalidated spec.database.customExtraParams field, enabling exfiltration of sensitive files - including Kubernetes service account tokens - from the operator pod. An attacker who exploits this can leverage the stolen token to impersonate the operator's service account and escalate privileges to cluster-admin level within the OpenShift cluster. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog.

Overprivileged ClusterRole assignments in Red Hat OpenShift AI's Data Science Pipelines Operator (DSPO) create a cluster-wide privilege escalation path if the operator pod is compromised. The DSPO ClusterRole grants capabilities well beyond operational necessity - including pod exec and cluster-wide RBAC management - directly violating the principle of least privilege (CWE-250). Successful exploitation of a compromised DSPO pod would allow an attacker to assume full administrative control over the entire Kubernetes cluster; no public exploit or CISA KEV listing has been identified at time of analysis, but the CVSS scope-change flag (S:C) confirms the blast radius extends far beyond the initial compromise boundary.

Sensitive credential disclosure in Red Hat OpenShift AI's odh-model-controller component exposes Kubernetes Secrets - including cloud provider credentials and API keys - across namespace boundaries to any authenticated user holding custom resource creation permissions. The root cause is a confused deputy flaw (CWE-441) in the loadSecret function, which accepts user-controlled namespace input without validation, allowing the controller's elevated cluster-wide RBAC permissions to be turned against secrets in namespaces the attacker could not directly access. No public exploit code or CISA KEV listing is identified at time of analysis.

Authentication bypass in TrustyAI Service (TAS) within Red Hat OpenShift AI (RHOAI) exposes the backend API to any pod on the cluster network without requiring valid credentials. The CVSS vector (AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) confirms that an attacker with a pod on the cluster-such as through a compromised workload or a malicious tenant pod in a multi-tenant deployment-can read, modify, delete, or poison AI model monitoring data and configurations with no additional barriers. No public exploit code or CISA KEV listing has been identified at time of analysis, but the root cause (CWE-306: Missing Authentication for Critical Function) means exploitation is trivially simple once cluster network adjacency is established.

Arbitrary code execution in Red Hat OpenShift AI's trustyai-service-operator enables authenticated cluster users to bypass pod security policies via crafted sidecar container configurations in LMEvalJob resources. The CVSS 8.1 (High) score reflects network-accessible exploitation requiring only low-privilege cluster authentication, with high confidentiality and integrity impact against the affected workload context. No public exploit code has been identified and no CISA KEV listing exists at time of analysis, but the low barrier of entry (any authenticated cluster user) elevates insider-threat and compromised-account risk for RHOAI deployments.

Authentication bypass in the Models-as-a-Service (MaaS) API component of Red Hat OpenShift AI (RHOAI) lets any pod already running in the cluster impersonate arbitrary users by forging the X-MaaS-Username and X-MaaS-Group HTTP headers, which the service trusts without independent verification. Because the MaaS API performs no first-party authentication and defers entirely to a Kuadrant AuthPolicy gateway that can be circumvented, a low-privileged workload can mint Kubernetes ServiceAccount tokens in other tenants' namespaces, revoke API keys, and exfiltrate model-access configuration - a full cross-tenant privilege escalation. There is no public exploit identified at time of analysis, and the issue is not listed in CISA KEV, but the 9.9 CVSS reflects near-total impact.

The MaaS (Model-as-a-Service) Gateway component in Red Hat OpenShift AI (RHOAI) is improperly configured, enabling any low-privileged authenticated user within the platform to act as a man-in-the-middle against all model-serving traffic. Affected users can intercept, read, log, and modify requests and responses traversing the gateway, exposing highly sensitive artifacts including API access keys, user input prompts, and model outputs. No public exploit code has been identified at time of analysis, and the vulnerability has not been added to the CISA KEV catalog, but the CVSS 8.8 rating with high confidentiality, integrity, and availability impact reflects the severity of unrestricted traffic access within a shared AI serving environment.

Authentication bypass in the odh-dashboard web console of Red Hat OpenShift AI (RHOAI) lets a low-privileged actor already inside the cluster impersonate any user — including cluster administrators — by supplying an arbitrary access token to a component that was incorrectly bound to a reachable network interface. Because the impersonated identity is honored against the Kubernetes API, this escalates to arbitrary code execution, privilege escalation, and information disclosure across the cluster. There is no public exploit identified at time of analysis, no CISA KEV listing, and no EPSS score was provided, but the CVSS 8.8 (High) rating and full C/I/A impact make it a serious internal-threat priority.

Denial of service in the Feast Feature Server (the Python feature-store serving component, also shipped within Red Hat OpenShift AI/RHOAI) lets remote unauthenticated attackers exhaust host resources through its `/ws/chat` WebSocket endpoint. Because the endpoint accepts unlimited concurrent connections and unbounded message traffic, opening many simultaneous sockets drains memory, CPU, and file descriptors until legitimate clients are locked out. There is no public exploit identified at time of analysis and this is not listed in CISA KEV; the upstream fix in PR #192 caps connections, message size, and message rate.

Sensitive information disclosure in Red Hat OpenShift AI's vllm-orchestrator-gateway component exposes bearer tokens and full chat payloads because the production binary writes all incoming Authorization headers and complete request bodies to persistent logs. Any user holding logging privileges can read these logs to harvest live credentials and potentially PII-laden conversation content. There is no public exploit identified at time of analysis, and the issue is not listed in CISA KEV.

Server-side request forgery in the file_type content detector of guardrails-detectors (a component shipped with Red Hat OpenShift AI/RHOAI) allows a remote attacker to submit an arbitrary XML Schema Definition (XSD) that the parser resolves without restriction, coercing the server into fetching attacker-chosen URLs or reading local files. Because the CVSS vector is AV:N/PR:N/UI:N with a changed scope and high confidentiality impact (base score 9.3), an unauthenticated attacker can pivot into internal networks and harvest secrets such as cloud provider credentials. There is no public exploit identified at time of analysis, and the flaw is not listed in CISA KEV.

Unproxied metrics port exposure in the gorch service template of trustyai-service-operator (part of Red Hat OpenShift AI) allows any pod on the cluster network to access orchestrator and detector metrics endpoints while bypassing kube-rbac-proxy authentication. The flaw manifests specifically when authentication is enabled - the configuration that should be protective is the same one under which the bypass exists. CVSS PR:L confirms exploitation requires a pod already running on the cluster network, limiting blast radius to actors with at least minimal cluster access. No public exploit code identified and no CISA KEV listing at time of analysis.

Arbitrary file write in the Feast Feature Server's `/save-document` endpoint lets an unauthenticated remote attacker write attacker-controlled JSON to the host filesystem, bypassing the endpoint's path restrictions to overwrite application configuration or startup scripts. Because no credentials are required (CVSS 9.1, PR:N), any network-reachable attacker can corrupt system integrity, cause denial of service through disk exhaustion, or potentially achieve remote code execution. This flaw also ships in Red Hat OpenShift AI (RHOAI), which bundles Feast; there is no public exploit identified at time of analysis and it is not in CISA KEV.

Use-after-free in FFmpeg's RASC video decoder exposes Red Hat Enterprise Linux AI 3 and Red Hat OpenShift AI deployments to denial-of-service attacks via crafted media files. The decode_move() function retains a raw pointer into a heap-allocated decompressed buffer that is subsequently reallocated during move-table processing, leaving the pointer dangling; reading through it crashes the process. No public exploit or KEV listing has been identified at time of analysis, but the network-accessible attack vector (file delivery over the internet) and lack of authentication prerequisites make this a realistic threat to any environment that processes untrusted AVI content using the affected FFmpeg builds.

Image input manipulation in vLLM's multimodal preprocessing pipeline allows remote, unauthenticated network attackers to craft images with specific EXIF orientation or PNG tRNS transparency metadata that, when converted to RGB by vLLM, produces semantically altered image content fed to the LLM - affecting the integrity of inference outputs and potentially the reliability of the inference service. Affected deployments include Red Hat AI Inference Server across RHEL AI 3 and Red Hat OpenShift AI (RHOAI) environments. No public exploit code has been identified at time of analysis and the vulnerability is not listed in the CISA KEV catalog; however, sensitive inference workloads processing user-supplied images (e.g., document classification, content moderation) face a higher practical risk from subtle input distortion attacks.

A remote attacker can trigger a heap out-of-bounds write in FFmpeg's DVD subtitle parser by providing a crafted MPEG-PS/VOB file containing a malicious subtitle stream. This signed integer overflow flaw leads to application crash or potential arbitrary code execution, affecting any software that relies on FFmpeg for media parsing. No public exploit is known, and EPSS indicates a low exploitation probability (0.04%).

Kubernetes Service Account token disclosure in the odh-dashboard component of Red Hat OpenShift AI (RHOAI) lets an authenticated low-privileged user retrieve SA tokens via an exposed NodeJS endpoint, then reuse them to reach Kubernetes resources beyond the dashboard's intended scope. Rated CVSS 9.9 with a changed scope, the flaw effectively converts limited dashboard access into broad cluster access. There is no public exploit identified at time of analysis and EPSS is very low (0.06%), but a vendor patch is already available via Red Hat errata.

The Feast Feature Server contains a path traversal vulnerability in its `/read-document` endpoint that allows unauthenticated remote attackers to read arbitrary files accessible to the server process, including sensitive system files, application configurations, and credentials. Red Hat OpenShift AI (RHOAI) deployments are confirmed affected across multiple versions. The vulnerability is rated 7.5 (High) with network-based exploitation requiring no authentication or user interaction, though no active exploitation (KEV) or public proof-of-concept is currently documented.