RHSA-2026:10184HighCVSS 9.9

Red Hat Security Advisory: RHOAI 2.25.5 - Red Hat OpenShift AI

Published
April 23, 2026
Last Modified
August 21, 2026

🔗 CVE IDs covered (50)

CVE-2025-6242 →CVE-2025-69223 →CVE-2026-24281 →CVE-2026-24308 →CVE-2026-27904 →CVE-2026-31892 →CVE-2025-61728 →CVE-2025-69228 →CVE-2026-2472 →CVE-2026-22807 →CVE-2026-31837 →CVE-2025-61726 →CVE-2026-0847 →CVE-2026-25679 →CVE-2026-27959 →CVE-2026-28356 →CVE-2026-32597 →CVE-2026-33236 →CVE-2026-33871 →CVE-2026-25223 →CVE-2025-11157 →CVE-2025-66471 →CVE-2025-69227 →CVE-2026-24049 →CVE-2026-24486 →CVE-2026-26007 →CVE-2026-26996 →CVE-2025-61729 →CVE-2025-68131 →CVE-2025-69534 →CVE-2026-25639 →CVE-2026-27137 →CVE-2026-28229 →CVE-2026-30922 →CVE-2026-31958 →CVE-2025-12103 →CVE-2025-14009 →CVE-2025-66418 →CVE-2026-32274 →CVE-2026-32640 →CVE-2026-0846 →CVE-2026-1002 →CVE-2026-25990 →CVE-2026-27628 →CVE-2026-33870 →CVE-2026-2492 →CVE-2026-21441 →CVE-2026-22773 →CVE-2026-24779 →CVE-2026-27888 →

📋 Description

CVE-2025-6242 — vllm: Server Side request forgery (SSRF) in MediaConnector CVE-2025-11157 — feast: Feast: Remote Code Execution via insecure YAML deserialization CVE-2025-12103 — openshift-ai: Trusty AI Grants All Authenticated users to list pods in any namespace CVE-2025-14009 — nltk: Zip Slip Vulnerability in nltk Leading to Code Execution CVE-2025-61726 — golang: net/url: Memory exhaustion in query parameter parsing in net/url CVE-2025-61728 — golang: archive/zip: Excessive CPU consumption when building archive index in archive/zip CVE-2025-61729 — crypto/x509: golang: Denial of Service due to excessive resource consumption via crafted certificate CVE-2025-66418 — urllib3: urllib3: Unbounded decompression chain leads to resource exhaustion CVE-2025-66471 — urllib3: urllib3 Streaming API improperly handles highly compressed data CVE-2025-68131 — cbor2: cbor2: Information Disclosure via shared memory in CBORDecoder reuse CVE-2025-69223 — aiohttp: AIOHTTP's HTTP Parser auto_decompress feature is vulnerable to zip bomb CVE-2025-69227 — aiohttp: aiohttp: Denial of Service via specially crafted POST request CVE-2025-69228 — aiohttp: aiohttp: Denial of Service via memory exhaustion from crafted POST request CVE-2025-69534 — python-markdown: denial of service via malformed HTML-like sequences CVE-2026-0846 — nltk: NLTK: Arbitrary file read via improper path validation in filestring() function CVE-2026-0847 — nltk: NLTK: Arbitrary file read via path traversal vulnerability CVE-2026-1002 — io.vertx/vertx-core: static handler component cache can be manipulated to deny the access to static files CVE-2026-2472 — google-cloud-aiplatform: google-cloud-aiplatform: Arbitrary code execution via Stored Cross-Site Scripting (XSS) CVE-2026-2492 — tensorflow: TensorFlow: Local privilege escalation via uncontrolled search path for plugins CVE-2026-21441 — urllib3: urllib3 vulnerable to decompression-bomb safeguard bypass when following HTTP redirects (streaming API) CVE-2026-22773 — vllm: vLLM: Denial of Service via specially crafted image in multimodal model serving CVE-2026-22807 — vLLM: vLLM: Arbitrary code execution via untrusted model loading CVE-2026-24049 — wheel: wheel: Privilege Escalation or Arbitrary Code Execution via malicious wheel file unpacking CVE-2026-24281 — Apache ZooKeeper: Apache ZooKeeper: Impersonation of servers or clients via reverse DNS spoofing CVE-2026-24308 — Apache ZooKeeper: Apache ZooKeeper: Information disclosure via improper handling of configuration values CVE-2026-24486 — python-multipart: Python-Multipart: Arbitrary file write via path traversal vulnerability CVE-2026-24779 — vLLM: vLLM: Server-Side Request Forgery allows internal network access CVE-2026-25223 — Fastify: Fastify: Validation bypass due to malformed Content-Type header leading to integrity impact CVE-2026-25639 — axios: Axios affected by Denial of Service via proto Key in mergeConfig CVE-2026-25679 — net/url: Incorrect parsing of IPv6 host literals in net/url CVE-2026-25990 — pillow: Pillow: Out-of-bounds Write via Specially Crafted PSD Image CVE-2026-26007 — cryptography: cryptography Subgroup Attack Due to Missing Subgroup Validation for SECT Curves CVE-2026-26996 — minimatch: minimatch: Denial of Service via specially crafted glob patterns CVE-2026-27137 — crypto/x509: Incorrect enforcement of email constraints in crypto/x509 CVE-2026-27628 — pypdf: possible infinite loop when loading circular /Prev entries in cross-reference streams CVE-2026-27888 — pypdf: pypdf: Denial of Service via crafted PDF CVE-2026-27904 — minimatch: Minimatch: Denial of Service via catastrophic backtracking in glob expressions CVE-2026-27959 — koa: Koa: Host header injection vulnerability due to malformed HTTP Host header parsing CVE-2026-28229 — argo-workflows: Argo Workflows has unauthorized access to Argo Workflows Template CVE-2026-28356 — multipart: denial of service via maliciously crafted HTTP or multipart segment headers CVE-2026-30922 — pyasn1: pyasn1 Vulnerable to Denial of Service via Unbounded Recursion CVE-2026-31837 — istio: Istio: Information disclosure and authentication bypass via JWKS resolver unavailability CVE-2026-31892 — github.com/argoproj/argo-workflows: Argo Workflows: Security bypass allows privilege escalation via podSpecPatch field CVE-2026-31958 — tornado-python: Tornado: Denial of Service via large multipart bodies CVE-2026-32274 — black: Black: Arbitrary file writes from unsanitized user input in cache file name CVE-2026-32597 — pyjwt: PyJWT accepts unknown crit header extensions (RFC 7515 §4.1.11 MUST violation) CVE-2026-32640 — simpleeval: SimpleEval: Arbitrary code execution via sandbox escape due to improper object handling CVE-2026-33236 — nltk: NLTK: Arbitrary file overwrite and creation via path traversal in XML index files CVE-2026-33870 — io.netty/netty-codec-http: Netty: Request smuggling via incorrect parsing of HTTP/1.1 chunked transfer encoding extension values CVE-2026-33871 — netty: Netty: Denial of Service via HTTP/2 CONTINUATION frame flood

🎯 Affected products200

  • Red Hat OpenShift AI 2.25
  • registry.redhat.io/rhoai/odh-built-in-detector-rhel9@sha256:025b8021c709dd6a494af53c3b219cfd8fbdfb6d12bb5c069cfcf20a57ac33f0_s390x as a component of Red Hat OpenShift AI 2.25
  • registry.redhat.io/rhoai/odh-built-in-detector-rhel9@sha256:12bd4bcb95d4c632c90e55dfc6ce9418fb4155dfd9b315abfd9c10a85261e142_ppc64le as a component of Red Hat OpenShift AI 2.25
  • registry.redhat.io/rhoai/odh-built-in-detector-rhel9@sha256:39644ca034be600549ce9a4e200e3e8f1454ea282bd462645c59818f06319148_amd64 as a component of Red Hat OpenShift AI 2.25
  • registry.redhat.io/rhoai/odh-built-in-detector-rhel9@sha256:de2ec0963e73b884de7c672c77cccd88ed193e27698492700932080a73d99c61_arm64 as a component of Red Hat OpenShift AI 2.25
  • registry.redhat.io/rhoai/odh-caikit-nlp-rhel9@sha256:13a6eaeb91dfd2d4abefda94c8dbc4f303704879247e2badeed01efe6bb8fc69_arm64 as a component of Red Hat OpenShift AI 2.25
  • registry.redhat.io/rhoai/odh-caikit-nlp-rhel9@sha256:67a2dfc9390d5eab89506506c0dd8a12e03c74884d95e18299dc8e1628983d76_amd64 as a component of Red Hat OpenShift AI 2.25
  • registry.redhat.io/rhoai/odh-caikit-tgis-serving-rhel9@sha256:7f45c61f9c5cf97867f60ac97a40df84fc76662252ed59c73da9b1f1670e7d72_amd64 as a component of Red Hat OpenShift AI 2.25
  • registry.redhat.io/rhoai/odh-caikit-tgis-serving-rhel9@sha256:83ab708730c2450dfe7e64fe1165e407f188d4548d45acd7865ef2ec6aff8447_arm64 as a component of Red Hat OpenShift AI 2.25
  • registry.redhat.io/rhoai/odh-codeflare-operator-rhel9@sha256:95ba139d42fc9003ed3b2ab2b31f285b23a66ad41379bad804e326e8cfacc0f4_amd64 as a component of Red Hat OpenShift AI 2.25
  • registry.redhat.io/rhoai/odh-codeflare-operator-rhel9@sha256:c99a6194eedc71d13f8a4feb20a896f83239f9d0beaecb7419e953e292ba0f12_arm64 as a component of Red Hat OpenShift AI 2.25
  • registry.redhat.io/rhoai/odh-dashboard-rhel9@sha256:0cdaba4d21e61d75112aaa95daaefef790d5c328a8c35209b40c8954d1ee4992_amd64 as a component of Red Hat OpenShift AI 2.25
  • registry.redhat.io/rhoai/odh-dashboard-rhel9@sha256:b425bf339ae728811735602aa997f57d809863ff428b779d7e4b05805b72cb8c_ppc64le as a component of Red Hat OpenShift AI 2.25
  • registry.redhat.io/rhoai/odh-dashboard-rhel9@sha256:d961421705c992d735c17bc699245284ef1c5822de608507a513fb28f579a851_arm64 as a component of Red Hat OpenShift AI 2.25
  • registry.redhat.io/rhoai/odh-dashboard-rhel9@sha256:f19ceec584c602e0b06a2a3b2e6d18f5a0da6161c61a1e7eceed86a7978156a9_s390x as a component of Red Hat OpenShift AI 2.25
  • registry.redhat.io/rhoai/odh-data-science-pipelines-argo-argoexec-rhel9@sha256:3c8b56f1d7e2084a93dd6ea951e4328bb969fa3443452790db10a9a01bead27b_ppc64le as a component of Red Hat OpenShift AI 2.25
  • registry.redhat.io/rhoai/odh-data-science-pipelines-argo-argoexec-rhel9@sha256:c7b7f0e7a0864676517e56b9fd75d2ce85b152708842b83f74720519490a4b36_arm64 as a component of Red Hat OpenShift AI 2.25
  • registry.redhat.io/rhoai/odh-data-science-pipelines-argo-argoexec-rhel9@sha256:ffdfd1b2f082296677737ea1a585cd29016beaa72a8c88b67bc74e114624eb92_amd64 as a component of Red Hat OpenShift AI 2.25
  • registry.redhat.io/rhoai/odh-data-science-pipelines-argo-workflowcontroller-rhel9@sha256:72f4630626f2089823c9a9c413b5bad245e63a7569468581804e34790fd3941e_ppc64le as a component of Red Hat OpenShift AI 2.25
  • registry.redhat.io/rhoai/odh-data-science-pipelines-argo-workflowcontroller-rhel9@sha256:acaba51bd115f189ba1f818c1bf141df0907bb354e2639a4aa4dad3ff7c68335_amd64 as a component of Red Hat OpenShift AI 2.25
  • registry.redhat.io/rhoai/odh-data-science-pipelines-argo-workflowcontroller-rhel9@sha256:e4214f06d7770398ee48065b1381528bc55084f193a35e10ff0def2f56967f71_arm64 as a component of Red Hat OpenShift AI 2.25
  • registry.redhat.io/rhoai/odh-data-science-pipelines-operator-controller-rhel9@sha256:0b886b98e9bfd9c15b13b4809b465f81bcc7542f602508b42522f5eda2341731_ppc64le as a component of Red Hat OpenShift AI 2.25
  • registry.redhat.io/rhoai/odh-data-science-pipelines-operator-controller-rhel9@sha256:69770ab1b3f2bb3d6555cdc042337e5fa7c6eccd468d56bb3c758d080210c163_amd64 as a component of Red Hat OpenShift AI 2.25
  • registry.redhat.io/rhoai/odh-data-science-pipelines-operator-controller-rhel9@sha256:a2f2a42eccc294a009e39b1953ead3cc27b90385a746e76570691e243673de94_arm64 as a component of Red Hat OpenShift AI 2.25
  • registry.redhat.io/rhoai/odh-feast-operator-rhel9@sha256:717fdf99ccd5098dbb708895c9069f91fd883641cbd05a4c41b9caee4891c4ae_arm64 as a component of Red Hat OpenShift AI 2.25
  • registry.redhat.io/rhoai/odh-feast-operator-rhel9@sha256:b255a2045b661ffb702e2aafce2911ab4d5263bab3b1aa66205c8aadaacf51d3_ppc64le as a component of Red Hat OpenShift AI 2.25
  • registry.redhat.io/rhoai/odh-feast-operator-rhel9@sha256:f9f4b61ab07f9d78ce92cbe5364c6a9ee635aedaf1caa97f490d050232e59f0d_amd64 as a component of Red Hat OpenShift AI 2.25
  • registry.redhat.io/rhoai/odh-feature-server-rhel9@sha256:0e355f088ca563163bc363f9b64b5ecbcacca919b724aab1cef4f9f218e9e775_arm64 as a component of Red Hat OpenShift AI 2.25
  • registry.redhat.io/rhoai/odh-feature-server-rhel9@sha256:7c841a7b0be5bc5319300fd2a786a0c26698ea3ee4de524c4c2dd8f7da10d4ce_amd64 as a component of Red Hat OpenShift AI 2.25
  • registry.redhat.io/rhoai/odh-feature-server-rhel9@sha256:e5d148e2bf1d88e746dfc4070499db92aff859986a15959e919ea262ca89e3d2_ppc64le as a component of Red Hat OpenShift AI 2.25
  • +170 more not shown

✅ Remediation

For Red Hat OpenShift AI 2.25.5 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this errata update: https://docs.redhat.com/en/documentation/red_hat_openshift_ai/ Workaround: Red Hat has investigated whether a possible mitigation exists for this issue, and has not been able to identify a practical example. Please update the affected package as soon as possible. Workaround: Implement strict access controls and least privilege principles for the Feast Kubernetes materializer job. Ensure that only authorized users and processes have write access to the `/var/feast/feature_store.yaml` and `/var/feast/materialization_config.yaml` files on the worker pods. This can be achieved through Kubernetes Role-Based Access Control (RBAC) policies and appropriate OpenShift security context constraints to limit file system access. Workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability. Workaround: To mitigate this vulnerability, implement a timeout in your archive/zip processing logic to abort the operation if it exceeds a few seconds, preventing the application from consuming an excessive amount of resources. Workaround: To mitigate this issue, applications utilizing the `cbor2` library should avoid reusing `CBORDecoder` instances when processing data from different trust levels. If `CBORDecoder` reuse is unavoidable, ensure that sensitive data is not processed by a decoder instance that will subsequently handle untrusted input. This operational control prevents an attacker from accessing prior decoded information. Workaround: No mitigation is currently available that meets Red Hat Product Security’s standards for usability, deployment, applicability, or stability. Workaround: To mitigate this vulnerability, wrap your markdown parsing function in a try/except block. This catches the unhandled exception, preventing both the application crash and the stack trace leak. Workaround: To mitigate this vulnerability, consider disabling the static handler cache by configuring the StaticHandler instance with setCachingEnabled(false), for example: ~~~ StaticHandler staticHandler = StaticHandler.create().setCachingEnabled(false); ~~~ Workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability. Workaround: To mitigate this issue, ensure that vLLM instances are configured to load models only from trusted and verified repositories. Restrict access to the model repository path to prevent unauthorized modification or introduction of malicious code. Implement strict access controls and integrity checks for all model sources. Workaround: To mitigate this issue, disable reverse DNS lookup in Apache ZooKeeper's client and quorum protocols. This can be achieved by configuring the `zookeeper.ssl.hostnameVerification.disableReverseDns` property to `true`. This configuration option is available in Apache ZooKeeper versions 3.8.6 and 3.9.5 and later. A restart of the ZooKeeper service will be required for the change to take effect. Workaround: To mitigate this vulnerability, avoid enabling the `UPLOAD_KEEP_FILENAME=True` configuration option in applications using `python-multipart`. This option, when used with `UPLOAD_DIR`, allows an attacker to write files to arbitrary locations. Disabling or not configuring `UPLOAD_KEEP_FILENAME=True` prevents the path traversal vulnerability. Workaround: To mitigate this issue, restrict network access to the vLLM service to only trusted clients. Implement strict network segmentation for vLLM pods in containerized environments to limit potential lateral movement. Ensure that vLLM instances are not exposed to untrusted external networks without proper access controls and input validation at the perimeter. Workaround: Red Hat is not aware of a practical temporary workaround that fully mitigates this issue or meets Red Hat Product Security's standards for usability, deployment, applicability, or stability. Customers are advised to apply the relevant security updates once they become available. Workaround: To mitigate this issue, ensure that any applications utilizing the NLTK downloader are configured to only interact with trusted XML index servers. Restrict network access for the application using NLTK to prevent connections to untrusted external resources. This operational control reduces the risk of an attacker controlling a malicious server to exploit the path traversal vulnerability. A service restart or reload may be required for network configuration changes to take effect.

🔗 References (54)