Openshift Ai Red Hat Openshift Ai

  1. Vendors
  2. Red Hat
  3. Openshift Ai

Don't miss out!

Thousands of developers use stack.watch to stay informed.
Get an email whenever new security vulnerabilities are reported in Red Hat Openshift Ai.

Recent Red Hat Openshift Ai Security Advisories

Advisory Title Published
RHSA-2026:53263 (RHSA-2026:53263) RHOAI 3.3.6 - Red Hat OpenShift AI August 11, 2026
RHSA-2026:53262 (RHSA-2026:53262) RHOAI 3.4.3 - Red Hat OpenShift AI August 11, 2026
RHSA-2026:53261 (RHSA-2026:53261) RHOAI 2.25.10 - Red Hat OpenShift AI August 11, 2026
RHSA-2026:42644 (RHSA-2026:42644) RHOAI 2.25.9 - Red Hat OpenShift AI July 21, 2026
RHSA-2026:37275 (RHSA-2026:37275) RHOAI 3.3.5 - Red Hat OpenShift AI July 9, 2026
RHSA-2026:34456 (RHSA-2026:34456) RHOAI 3.4.2 - Red Hat OpenShift AI July 1, 2026
RHSA-2026:30056 (RHSA-2026:30056) RHOAI 3.3.4 - Red Hat OpenShift AI June 25, 2026
RHSA-2026:28960 (RHSA-2026:28960) RHOAI 2.25.8 - Red Hat OpenShift AI June 24, 2026
RHSA-2026:27784 (RHSA-2026:27784) RHOAI 3.4.1 - Red Hat OpenShift AI June 22, 2026
RHSA-2026:26826 (RHSA-2026:26826) RHOAI 3.5-ea.1 - Red Hat OpenShift AI June 17, 2026

By the Year

In 2026 there have been 318 vulnerabilities in Red Hat Openshift Ai with an average score of 7.8 out of ten. Last year, in 2025 Openshift Ai had 7 security vulnerabilities published. That is, 311 more vulnerabilities have already been reported in 2026 as compared to last year. However, the average CVE base score of the vulnerabilities in 2026 is greater by 1.72.

Year Vulnerabilities Average Score
2026 318 7.83
2025 7 6.11
2024 2 8.10

It may take a day or so for new Openshift Ai vulnerabilities to show up in the stats or in the list of recent security vulnerabilities. Additionally vulnerabilities may be tagged under a different product or component name.

Recent Red Hat Openshift Ai Security Vulnerabilities

FFmpeg TDSC Cursor Heap Overflow in tdsc_load_cursor()
CVE-2026-18393 5.4 - Medium - August 28, 2026

A flaw was found in FFmpeg. The tdsc_load_cursor() function writes beyond the bounds of a heap-allocated buffer when processing crafted TDSC cursor data. A remote attacker could exploit this by supplying a specially crafted video file, potentially leading to a denial of service or arbitrary code execution.

Memory Corruption

jwcrypto JWE Deserialization Memory Overrun DoS
CVE-2026-80179 5.9 - Medium - August 27, 2026

A flaw was found in jwcrypto. A remote attacker can send a specially crafted JSON Web Encryption (JWE) token containing numerous period delimiters. This malformed token can force the JWE.deserialize() function to allocate excessive memory, leading to a MemoryError. This issue results in a denial of service (DoS) for services that process untrusted JWE values.

Allocation of Resources Without Limits or Throttling

Risky OpenShift AI ServiceAccounts Grant Cluster-Admin Privileges
CVE-2026-15218 7.9 - High - August 17, 2026

A flaw was found in the maas-api and maas-controller ServiceAccounts within Red Hat OpenShift AI. These ServiceAccounts are granted cluster-wide permissions that exceed their operational requirements. An attacker who compromises the identity of these ServiceAccounts, either through a remote code execution vulnerability or by creating a malicious pod in the same namespace, could exploit these excessive permissions. This could lead to full cluster administrator privileges through the creation of new ClusterRoleBindings or the disclosure of sensitive information by accessing all secrets across the cluster.

Incorrect Privilege Assignment

Unauthorized SA Elevation in Red Hat Data Science Pipelines
CVE-2026-18620 7.1 - High - August 10, 2026

A flaw was found in Data Science Pipelines. A restricted user, or tenant, can exploit an improper authorization vulnerability in the setDefaultServiceAccount function. By specifying a more privileged ServiceAccount (SA) during a CreateRun request, an attacker can bypass authorization checks. This allows the tenant to run their containers with elevated privileges, potentially leading to the disclosure of sensitive information (secrets) and the ability to execute commands within other users' pods.

Insecure Direct Object Reference / IDOR

ml-metadata HTTP/2 DoS via Outdated gRPC
CVE-2026-18618 7.5 - High - August 10, 2026

A flaw was found in ml-metadata. The statically-linked gRPC stack in ml-metadata is outdated, making it vulnerable to known HTTP/2 denial of service (DoS) issues. An in-cluster attacker, with network access to the MLMD pod, could exploit these vulnerabilities by sending specially crafted HTTP/2 requests. This could lead to a denial of service by crashing the MLMD pod, disrupting all pipeline runs in the affected namespace.

Allocation of Resources Without Limits or Throttling

Unauth Data Science Pipelines Operator: Weak PRNG Exposes MariaDB/MinIO Creds
CVE-2026-18611 7.5 - High - August 10, 2026

A flaw was found in the Data Science Pipelines Operator. This vulnerability allows an unauthenticated attacker to derive sensitive credentials, such as MariaDB root/user passwords and MinIO access/secret keys, if they can access the MinIO Route or MariaDB Service. The flaw occurs because the operator uses a cryptographically weak pseudo-random number generator (PRNG) to generate these credentials, making them predictable. Successful exploitation could lead to unauthorized access to all pipeline artifacts and metadata, resulting in significant information disclosure.

PRNG

RHOAI Training-Operator: Privilege Escalation in K8s
CVE-2026-18982 8.8 - High - August 10, 2026

A flaw was found in the RHOAI training-operator. This vulnerability allows a user with standard edit or admin roles in any Kubernetes namespace to escalate their privileges. Through the creation of training jobs, an attacker can impersonate service accounts, access the host filesystem, and potentially execute arbitrary code remotely. This issue arises from the aggregation of training job permissions onto native Kubernetes edit and admin ClusterRoles, coupled with unrestricted PodTemplateSpec passthrough.

Execution with Unnecessary Privileges

RHOAI Overlay Causing Privilege Escalation via Edit ClusterRole
CVE-2026-18951 8.8 - High - August 10, 2026

A flaw was found in the Red Hat OpenShift AI (RHOAI) overlay for the training operator. The RHOAI overlay incorrectly aggregates `trainjobs` management permissions into the native Kubernetes `edit ClusterRole`. This allows any user with `edit ClusterRole` permissions in a namespace to create, modify, and delete `TrainJobs`. When combined with a separate vulnerability (TRN-01) that permits arbitrary pod configurations, a remote attacker with namespace editor privileges could exploit this to escalate privileges, potentially leading to arbitrary code execution.

Authorization

CVE-2026-18950: ODH Dashboard Privilege Escalation via RoleBinding Manipulation
CVE-2026-18950 8.8 - High - August 10, 2026

A flaw was found in odh-dashboard. An authenticated user of the dashboard can exploit a vulnerability related to how RoleBindings are created. The system does not properly validate the `roleRef` field, allowing a user to specify an arbitrary role, including highly privileged ones like `cluster-admin`. This can lead to privilege escalation, where an attacker gains unauthorized elevated access within their namespace and potentially persistent control over the system.

Improper Privilege Management

Privilege Escalation via Overly Broad SA Permissions in odhdashboard
CVE-2026-18949 8.8 - High - August 10, 2026

A flaw was found in odh-dashboard. This vulnerability allows an attacker, who has compromised the dashboard's Service Account (SA) token, to exploit overly broad permissions granted to the SA. This enables the attacker to escalate their privileges to cluster-administrator level, gain access to sensitive data like credentials and keys across the entire cluster, and disrupt multi-tenant isolation.

Execution with Unnecessary Privileges

Unauthenticated Code Exec via UDF Deserialization in Feast (Python)
CVE-2026-18948 9.9 - Critical - August 10, 2026

A flaw was found in Feast. The system improperly deserializes user-defined functions (UDFs) stored in its registry, which are serialized using the 'dill' library. This allows a remote attacker to store a malicious UDF, leading to unauthenticated arbitrary code execution on the feature server in default configurations. An authenticated attacker can also achieve arbitrary code execution on the registry server by bypassing authorization checks during deserialization. This vulnerability can result in cross-tenant data access and lateral movement within the system.

Marshaling, Unmarshaling

Feast /materialize Auth Bypass Enables DoS
CVE-2026-18947 8.5 - High - August 10, 2026

A flaw was found in Feast. An authorization bypass vulnerability exists in the /materialize and /materialize-incremental endpoints. By sending a specially crafted request that omits the feature_views field, an attacker can bypass intended permission checks. This allows an unauthenticated remote attacker, or any authenticated user, to trigger a full re-materialization of all feature views. The consequence is a Denial of Service (DoS) due to data corruption and significant resource consumption across all tenants.

AuthZ

Privilege Escalation via Code Injection in Feast Operator
CVE-2026-18942 5.5 - Medium - August 10, 2026

A flaw was found in the Feast operator. A malicious tenant could inject arbitrary code into their feature repository. This code would be executed by an automated process with elevated privileges, allowing the tenant to steal sensitive credentials. This could lead to a direct escalation of privileges, granting the tenant administrative control over the Kubernetes cluster.

Code Injection

Feast Default no_auth Enables Unauth RCE, DoS, Data Leakage
CVE-2026-18941 7.7 - High - August 10, 2026

A flaw was found in Feast and feast-operator. The default configuration for both the Feast SDK and the feast-operator is "no_auth," meaning no security manager is installed. This default allows unauthenticated and unauthorized access to feature-server, registry-server, and offline-server endpoints. A remote attacker, by exploiting this missing authentication, could achieve remote code execution (RCE) by storing a malicious User-Defined Function (UDF) on the feature-server, trigger a denial of service (DoS) by forcing re-materialization of all tenant features, and gain unauthorized access to cross-tenant data.

Missing Authentication for Critical Function

Red Hat Data Science Pipelines: API Bypass Grants Node-Root (CVE-2026-18621)
CVE-2026-18621 7.6 - High - August 10, 2026

A flaw was found in Data Science Pipelines (DSP). An attacker with namespace editor privileges can bypass security hardening by submitting a malicious Argo Workflow through the V1 API path. This allows the API server to create pods with elevated privileges, acting as a 'confused deputy' on behalf of the attacker. Successful exploitation grants the attacker node-root access, enabling arbitrary code execution and full control over the underlying node.

Incorrect Privilege Assignment

Red Hat DSPO: Dangerous Spec.Database Params Enable Local INFILE PrivEsc
CVE-2026-18617 8.8 - High - August 10, 2026

A flaw was found in the Data Science Pipelines Operator (DSPO). A namespace editor can exploit a vulnerability in the spec.database.customExtraParams field, which allows for the injection of dangerous parameters into the MySQL Data Source Name (DSN) string. By manipulating these parameters, an attacker can enable LOCAL INFILE functionality and exfiltrate sensitive files, such as the service account token, from the operator pod. This can lead to privilege escalation, allowing a namespace editor to gain cluster-admin privileges.

Mass Assignment

Red Hat DSPO ClusterRole Excess Privileges -> K8s Admin Access
CVE-2026-18608 8.7 - High - August 10, 2026

A flaw was found in the Data Science Pipelines Operator (DSPO). The operator's ClusterRole, which defines its permissions, includes extensive privileges beyond what is necessary for its operation. These excessive permissions, such as the ability to execute commands within pods and manage cluster-wide roles, could be exploited. If the DSPO pod were compromised, an attacker could leverage these privileges to gain full administrative control over the entire Kubernetes cluster.

Execution with Unnecessary Privileges

ODH Model-Controller LoadSecret Namespace Leak
CVE-2026-16456 6.5 - Medium - August 10, 2026

A flaw was found in the `odh-model-controller`. An authenticated user with permissions to create custom resources can exploit a vulnerability in the `loadSecret` function. This function improperly reads the Secret namespace from user-controlled input without validation. This allows an attacker to read sensitive API keys and cloud credentials from other namespaces, leading to information disclosure.

Confused Deputy

TrustyAI TAS Auth Bypass: Pods Bypass API Auth
CVE-2026-15581 8 - High - August 10, 2026

A flaw was found in the TrustyAI Service (TAS) deployment. This vulnerability allows any pod on the cluster network to bypass authentication and directly access the TAS backend API. An attacker can exploit this to read, tamper with, or delete monitoring data and configurations, and inject arbitrary data into the service, potentially disrupting tenant operations.

Missing Authentication for Critical Function

Red Hat TrustyAI Service Operator LMEvalJob Sidecar Injection CVE-2026-15467
CVE-2026-15467 8.1 - High - August 10, 2026

A flaw was found in the trustyai-service-operator's LMEvalJob controller. An authenticated user within the cluster can exploit this vulnerability by configuring a sidecar container to bypass existing security policies. This allows the user to enable and execute untrusted remote code, leading to arbitrary code execution within the cluster.

Incorrect Privilege Assignment

Privilege Escalation via Header Injection in Red Hat MaaS API
CVE-2026-14450 9.9 - Critical - August 10, 2026

A flaw was found in the MaaS API. This vulnerability allows any pod within the cluster to bypass the Kuadrant AuthPolicy gateway by forging HTTP headers, specifically `X-MaaS-Username` and `X-MaaS-Group`, which are trusted verbatim. This lack of first-party authentication enables an attacker to gain unauthorized access and escalate privileges. The concrete consequences include the ability to mint Kubernetes ServiceAccount tokens in other tenants' namespaces, revoke API keys, and exfiltrate sensitive model access configuration.

Authentication Bypass by Spoofing

RHOAI MaaS Gateway: Improper Config Lets Low-Privilege Users Intercept Data
CVE-2026-13717 8.8 - High - August 10, 2026

A flaw was found in the Red Hat OpenShift AI (RHOAI) MaaS Gateway. Improper configuration of the Gateway in a model-serving context allows a standard user with low privileges to intercept, read, log, and alter all MaaS model traffic. This includes sensitive information such as access keys, input prompts, and outputs, leading to significant information disclosure and data tampering.

Authorization

Auth Bypass in Red Hat ODH-Dashboard via Network Binding
CVE-2026-16745 8.8 - High - July 23, 2026

A flaw was found in odh-dashboard, the web console component of Red Hat OpenShift AI (RHOAI). Due to incorrect network binding, a malicious actor within the cluster can bypass authentication and impersonate any user by providing an arbitrary access token. This allows an attacker to gain unauthorized access to the Kubernetes API, potentially leading to arbitrary code execution, privilege escalation, or information disclosure.

Origin Validation Error

Feast Feature Server /ws/chat WS Auth Bypass Enables DOS
CVE-2026-23538 7.5 - High - July 16, 2026

A vulnerability was identified in the Feast Feature Server's `/ws/chat` endpoint that allows remote attackers to establish persistent WebSocket connections without any authentication. By opening a large number of simultaneous connections, an attacker can exhaust server resourcessuch as memory, CPU, and file descriptorsleading to a complete denial of service for legitimate users.

Allocation of Resources Without Limits or Throttling

vllm-orchestrator-gateway PII Leak: Logs Auth Headers & Chat Payloads
CVE-2026-15574 7.5 - High - July 13, 2026

A flaw was found in the vllm-orchestrator-gateway component. The system's production binary logs all incoming authorization headers and full chat payloads, which may contain personally identifiable information (PII) and secrets, to persistent logs. This sensitive data, including bearer tokens and chat content, can be accessed by any user with logging privileges. This vulnerability leads to information disclosure, potentially allowing an attacker to harvest credentials and sensitive conversation content.

Insertion of Sensitive Information into Externally-Accessible File or Directory

XSD Injection in guardrails-detectors File_Type Detector Enables SSRF & LFI
CVE-2026-15143 9.3 - Critical - July 10, 2026

A flaw was found in the file_type content detector of guardrails-detectors. This vulnerability allows a remote attacker to supply an arbitrary XML Schema Definition (XSD) string, which is processed without proper restrictions. This can lead to server-side requests to arbitrary URLs or local file reads, potentially resulting in sensitive information disclosure, such as cloud provider credentials or access to internal network services.

SSRF

Red Hat guardrails-detectors SSRF via crafted XSD blind request
CVE-2026-15378 9.3 - Critical - July 10, 2026

A flaw was found in the `guardrails-detectors` component. This vulnerability allows a remote attacker to perform a blind Server-Side Request Forgery (SSRF) by submitting a specially crafted XML Schema Definition (XSD) string. This can lead to unauthorized access to sensitive information, including credentials from cloud metadata services, Kubernetes API, internal MinIO, and other internal network endpoints. Additionally, it enables local file reads of critical data such as service account tokens and pod secrets.

SSRF

ReDoS in guardrails-detectors (Red Hat OpenShift AI)
CVE-2026-15154 6.5 - Medium - July 08, 2026

A flaw was found in `guardrails-detectors`, a component of Red Hat OpenShift AI. This vulnerability, known as Regular Expression Denial of Service (ReDoS), allows a remote attacker to provide specially crafted regular expressions to the public detection API. This can cause catastrophic backtracking, leading to a worker process consuming 100% CPU indefinitely and resulting in a denial of service for the entire guardrails-mediated LLM pipeline.

ReDoS

Unauthorized Access via Unproxied Metrics in TrustYai Gorch Service
CVE-2026-15063 6.3 - Medium - July 08, 2026

A flaw was found in the gorch service template, which is part of the trustyai-service-operator. Even when authentication is enabled, the gorch service exposes unproxied orchestrator and detector metrics ports. This allows any pod on the cluster network to directly access these ports, bypassing the kube-rbac-proxy and its authentication mechanisms. This could lead to unauthorized access to the orchestrator and detector metrics.

Missing Authentication for Critical Function

CVE-2026-15044: TrustyAI Service Operator Allows Unauthorized Cluster Access
CVE-2026-15044 6.3 - Medium - July 08, 2026

A flaw was found in the TrustyAI Service Operator. When deploying services like gorch or NemoGuardrails, if a specific security setting is not enabled, these services can expose their communication channels without requiring users to prove their identity. This allows any other program within the cluster to access the AI guardrails and orchestrator without proper authorization. An attacker could exploit this to gain unauthorized access to sensitive information and potentially make limited changes to the AI models.

Information Disclosure

Unauthenticated FS Write via /save-document in Feast Feature Server
CVE-2026-23537 9.1 - Critical - July 01, 2026

A vulnerability has been identified in the Feast Feature Servers `/save-document` endpoint that allows an unauthenticated remote attacker to write arbitrary JSON files to the server's filesystem. Although the system attempts to restrict file locations, these protections can be bypassed, enabling an attacker to overwrite vital application configurations or startup scripts. Because this flaw requires no credentials or special privileges, any attacker with network access to the server can potentially compromise the integrity of the system. This could lead to unauthorized system modifications, denial of service through disk exhaustion, or potential remote code execution.

AuthZ

fast-uri <=3.1.2/4.0.0 Unicode IDN Canonicalization Bug
CVE-2026-13676 7.5 - High - June 29, 2026

fast-uri versions 2.3.1 through 3.1.2 and 4.0.0 fail to canonicalize Unicode (IDN) hostnames for HTTP-family URLs. The IDN conversion path calls a helper that does not exist on the global URL constructor, silently leaving the host in its original Unicode form while normalize() and equal() still return values that differ from a WHATWG-compatible URL parser. Applications that use fast-uri to enforce host-based policy (denylists, loopback filtering, redirect validation, outbound proxy routing) before passing the same URL to Node's URL or fetch can be bypassed when the two implementations resolve the same input to different hosts. Patches: upgrade to fast-uri 3.1.3 for the 3.x line or 4.0.1 for the 4.x line. Workarounds: enforce host policy using the same URL parser used for the actual request, or reject non-ASCII hosts before policy checks.

Interpretation Conflict

FFmpeg RASC Decoder OOB Heap Write via Malformed Frame
CVE-2026-58049 7.6 - High - June 28, 2026

FFmpeg's RASC video decoder (decode_dlta in libavcodec/rasc.c) performs 32-bit reads and writes at the row cursor before the NEXT_LINE row-boundary check and validates the DLTA region in pixel rather than byte units, so a DLTA run on a PAL8 frame can access several bytes past the row allocation. A crafted media stream using the RASC FourCC, decoded by libavcodec, triggers a bitstream-controlled out-of-bounds heap write and adjacent out-of-bounds read, leading to memory corruption.

Memory Corruption

docling <2.91.0 Zip Slip in EasyOCR model download
CVE-2026-44017 8.3 - High - June 24, 2026

Docling simplifies document processing by parsing diverse formats and providing integrations with the generative AI ecosystem. Prior to 2.91.0, the EasyOCR model download functionality extracted ZIP archives without validating member paths, enabling Zip Slip attacks. If an attacker could compromise the model download source (via supply chain attack, DNS spoofing, or MITM), they could write arbitrary files to any location writable by the process, potentially achieving remote code execution by overwriting Python files or system binaries, persistent backdoors by modifying startup scripts or SSH keys, and data corruption or system compromise. This vulnerability is fixed in 2.91.0.

Directory traversal

Docling XXE in USPTO Patent XML Parser (2.13.02.73.9)
CVE-2026-44020 9.4 - Critical - June 24, 2026

Docling simplifies document processing by parsing diverse formats and providing integrations with the generative AI ecosystem. From 2.13.0 until 2.74.0, the USPTO patent XML parser used the standard xml.sax.parseString() without protection against XML External Entity (XXE) attacks. An attacker could craft malicious USPTO patent XML files with external entity references that could read arbitrary files from the server filesystem, perform Server-Side Request Forgery (SSRF) attacks, or cause denial of service through entity expansion (Billion Laughs attack). The vulnerability affects three USPTO patent format parsers: ICE (v4.x), Grant v2.5, and Application v1.x. This vulnerability is fixed in 2.74.0.

XEE

Docling 2.82-2.90: JS Exec via Playwright Rendering (SSRF/ROP)
CVE-2026-44016 8.2 - High - June 24, 2026

Docling simplifies document processing by parsing diverse formats and providing integrations with the generative AI ecosystem. FIn versions >= 2.82.0, < 2.91.0, if the HTML backend was explicitly configured for rendering (rendering option by default deactivated), then the Playwright-based rendering feature could allow JavaScript execution and unrestricted network access when processing untrusted HTML documents. An attacker could craft malicious HTML that executes arbitrary JavaScript in the rendering context or makes unauthorized network requests to internal services, potentially leading to SSRF attacks, data exfiltration, or remote code execution in the rendering environment. This vulnerability is fixed in 2.91.0.

Code Injection

Mistune CPU DoS via parse_link_text pre-3.3.0 (quadratic)
CVE-2026-49851 7.5 - High - June 24, 2026

Mistune is a Python Markdown parser with renderers and plugins. Prior to 3.3.0, Mistune is vulnerable to a CPU exhaustion DoS due to superlinear (approximately O(n²)) behavior in parse_link_text. When parsing Markdown containing many consecutive [ characters, parse_link_text repeatedly scans the input using a regex search inside a loop. Each iteration re-scans a large portion of the remaining string, resulting in quadratic-time behavior. An attacker-controlled Markdown input can therefore trigger excessive CPU usage with a very small payload. This vulnerability is fixed in 3.3.0.

Resource Exhaustion

feast <0.63.0 unsafe deserialization RCE via grpc in user_defined_function.body
CVE-2026-56121 8.8 - High - June 24, 2026

Feast before 0.63.0 contains an unsafe deserialization vulnerability that allows unauthenticated or unauthorized attackers to achieve remote code execution by sending a crafted gRPC request to the registry server. The user_defined_function.body field of an OnDemandFeatureView spec is decoded from base64 and passed to dill.loads() before any authorization check is performed, enabling attackers to embed a malicious serialized Python object with an arbitrary __reduce__ method to execute OS commands as the feast service account.

Marshaling, Unmarshaling

Jackson-Databind PTV Array Type Allowlist Bypass 2.10.0-2.18.8, 2.21.4, 3.1.4
CVE-2026-54513 8.1 - High - June 23, 2026

jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. From 2.10.0 until 2.18.8, 2.21.4, and 3.1.4, BasicPolymorphicTypeValidator.Builder.allowIfSubTypeIsArray() allowlists any array type based only on clazz.isArray(), without validating the array's component (element) type against the configured allowlist. A PTV built with allowIfSubTypeIsArray() plus an explicit concrete-type allowlist therefore still permits EvilType[] even though EvilType is not allowlisted. When Jackson deserializes the elements and no per-element type IDs are present, it instantiates the component type directly with no further PTV check, bypassing the allowlist. This vulnerability is fixed in 2.18.8, 2.21.4, and 3.1.4.

Denylist / Deny List

Traefik <=2.10.5 / <3.0.0-beta4 DoS via HTTP/2 Rapid Reset
CVE-2023-54365 7.5 - High - June 23, 2026

Traefik before 2.10.5 and 3.0.0-beta4 is affected by a denial-of-service vulnerability in HTTP/2 request handling inherited from the Go standard library's HTTP/2 implementation (CVE-2023-44487 / CVE-2023-39325, the 'Rapid Reset' technique). A remote attacker can rapidly create and cancel HTTP/2 streams to exhaust server resources and cause service unavailability.

Resource Exhaustion

vLLM <0.22.0: Assert in Activation Fxn Loading Enables AAE
CVE-2026-41523 7.5 - High - June 22, 2026

vLLM is an inference and serving engine for large language models (LLMs). Prior to 0.22.0, an assert-based security check in vLLM's activation function loading allows any unauthenticated attacker to achieve arbitrary code execution on the server by publishing a malicious HuggingFace model, when vLLM runs in Python optimized mode (python -O or PYTHONOPTIMIZE=1). This vulnerability is fixed in 0.22.0.

Code Injection

vLLM Authentication Bypass via ASGI Trust (0.3.0-0.22.0)
CVE-2026-48746 9.1 - Critical - June 22, 2026

vLLM is an inference and serving engine for large language models (LLMs). From 0.3.0 until 0.22.0, a vulnerability in ASGI web servers and starlette's trust on those web servers enables an authentication bypass of the OpenAI API AuthenticationMiddleware. It allows to use the API without providing the configured VLLM_API_KEY or --api-key. This vulnerability is fixed in 0.22.0.

HTTP Request Smuggling

LiteLLM proxy vulnerable prev1.84.0 (BerriAI)
CVE-2026-49468 8.1 - High - June 22, 2026

LiteLLM is a proxy server (AI Gateway) to call LLM APIs in OpenAI (or native) format. Prior to 1.84.0, a Host-header parsing flaw in the LiteLLM proxy could, under specific conditions, allow unauthenticated access to protected management routes. The auth layer derived the effective route from request.url.path in litellm/proxy/auth/auth_utils.py::get_request_route(), which Starlette reconstructs from the Host header. A crafted Host could therefore make the auth gate evaluate a different route from the one FastAPI dispatched. This vulnerability is fixed in 1.84.0.

Authentication Bypass by Spoofing

Jupyter_Server XSS & Kernel RCE via unsandboxed HTML Export, fixed in 2.20
CVE-2026-44727 9 - Critical - June 22, 2026

Jupyter Server is the backend for Jupyter web applications. Prior to 2.20, the nbconvert HTTP handlers in jupyter_server render user-authored notebook HTML under the Jupyter origin without a sandbox directive in their Content-Security-Policy. Combined with nbconvert.HTMLExporter's default non-sanitizing behavior, a notebook carrying an HTML payload in a display_data output triggers stored XSS with cookie access, full /api/* authority, and kernel RCE. This vulnerability is fixed in 2.20.

XSS

Path Traversal in NLTK data.load() prior to 3.10.0-rc1 via URL scheme
CVE-2026-54293 7.5 - High - June 22, 2026

NLTK (Natural Language Toolkit) is a suite of open source Python modules, data sets, and tutorials supporting research and development in Natural Language Processing. Prior to 3.10.0-rc1, nltk.data.load() in NLTK is vulnerable to path traversal via URL-encoded path separators and traversal segments when using the nltk: URL scheme. The unsafe-path regex check is performed before url2pathname() decodes the %xx sequences (a classic decode-after-check / TOCTOU-style flaw), allowing an attacker to bypass the protection documented in NLTK's SECURITY.md and read arbitrary files from the filesystem. While literal traversal strings such as ../../../etc/passwd are correctly blocked, encoded variants such as %2fetc%2fpasswd, %2e%2e%2f..., and ..%2f..%2f slip past the regex and are subsequently decoded into a real filesystem path. This vulnerability is fixed in 3.10.0-rc1.

Directory traversal

BerriAI litellm <=1.59.8 MCP Proxy auth flaw (UserAPIKeyAuth)
CVE-2026-12773 7.3 - High - June 21, 2026

A weakness has been identified in BerriAI litellm up to 1.59.8. Affected is the function UserAPIKeyAuth of the file litellm/proxy/_experimental/mcp_server/auth/user_api_key_auth_mcp.py of the component MCP Proxy. Executing a manipulation can lead to improper authentication. The attack may be launched remotely. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure.

authentification

vLLM 0.10.2-0.12.x Missing Sparse Tensor Validation, Potential DoS
CVE-2026-56340 8.8 - High - June 20, 2026

vLLM versions >= 0.10.2 and < 0.13.0 are missing sparse tensor validation in multimodal embeddings processing. Because PyTorch disables sparse tensor invariant checks by default, an attacker can submit crafted embedding requests with malformed (negative or out-of-bounds) tensor indices, when the prompt-embeds feature is enabled, to trigger crashes or resource exhaustion (denial of service), with potential for out-of-bounds/write-what-where memory corruption. This continues CVE-2025-62164, whose prior fix only disabled the feature by default rather than addressing the root cause.

Improper Input Validation

Quarkus HTTP Auth Bypass via Encoded ; and / Fixed 3.37.0
CVE-2026-50559 7.5 - High - June 19, 2026

Quarkus is a Java framework for building cloud-native applications. Prior to versions 3.37.0, 3.36.3, 3.33.2.1, 3.33.3, 3.27.4.1, 3.27.5, and 3.20.6.2, Quarkus HTTP path-based authorization policies can be bypassed using encoded semicolons (%3B) to smuggle matrix parameters past the security layer, and using encoded slashes (%2F) or backslashes (%5C) to access protected static resources. This is a distinct issue from CVE-2026-39852, which addressed only literal semicolon stripping. Versions 3.37.0, 3.36.3, 3.33.2.1, 3.33.3, 3.27.4.1, 3.27.5, and 3.20.6.2 contain a patch.

authentification

RCE via AV1 SVC ID Bounds in libaom Encoder
CVE-2026-56211 7.1 - High - June 19, 2026

A remote code execution vulnerability was found in libaom, the reference AV1 codec implementation. Insufficient bounds validation in the AV1 encoder's SVC (Scalable Video Coding) layer ID control allows an attacker to supply crafted video frame pixels that overlap with internal encoder layer context structures. In fork-based video processing services, an attacker can use this to hijack the cyclic refresh map pointer, brute-force the process base address via a crash oracle, and redirect control flow to achieve arbitrary command execution. Exploitation requires the target service to use libaom with SVC encoding enabled and accept attacker-supplied video frames.

Memory Corruption

libaom Heap-Buffer-Overflow in SVC Layer ID Read (CVE-2026-56210)
CVE-2026-56210 7.1 - High - June 19, 2026

A heap-buffer-overflow read vulnerability was found in libaom, the reference AV1 codec implementation. A missing bounds check in the SVC (Scalable Video Coding) layer ID control function allows setting a spatial_layer_id exceeding the configured number of layers. This causes an out-of-bounds heap read of approximately 40,728 bytes when computing a layer context array index. An attacker who can influence SVC encoder parameters in a network-facing service could exploit this for information disclosure (heap content leak) or denial of service (segmentation fault from hitting unmapped memory).

Out-of-bounds Read

Stay on top of Security Vulnerabilities

Want an email whenever new vulnerabilities are published for Red Hat Openshift Ai or by Red Hat? Click the Watch button to subscribe.

Red Hat
Vendor

Red Hat Openshift Ai
Product

subscribe