RHSA-2026:2695HighCVSS 8.7

Red Hat Security Advisory: RHOAI 2.25.2 - Red Hat OpenShift AI

Published
February 12, 2026
Last Modified
August 31, 2026

🔗 CVE IDs covered (14)

CVE-2025-66418 →CVE-2025-66471 →CVE-2025-66506 →CVE-2025-69223 →CVE-2026-21441 →CVE-2025-52881 →CVE-2025-66034 →CVE-2025-66626 →CVE-2025-68156 →CVE-2025-68476 →CVE-2026-24049 →CVE-2025-12805 →CVE-2025-12816 →CVE-2025-14925 →

📋 Description

CVE-2025-12805 — llama-stack-k8s-operator: Llama Stack service exposed across namespaces due to missing NetworkPolicy CVE-2025-12816 — node-forge: node-forge: Interpretation conflict vulnerability allows bypassing cryptographic verifications CVE-2025-14925 — accelerate: Hugging Face Accelerate: Remote Code Execution via Deserialization of Untrusted Data CVE-2025-52881 — runc: opencontainers/selinux: container escape and denial of service due to arbitrary write gadgets and procfs write redirects CVE-2025-66034 — fonttools: fontTools: Arbitrary file write leading to remote code execution via malicious .designspace file CVE-2025-66418 — urllib3: urllib3: Unbounded decompression chain leads to resource exhaustion CVE-2025-66471 — urllib3: urllib3 Streaming API improperly handles highly compressed data CVE-2025-66506 — github.com/sigstore/fulcio: Fulcio: Denial of Service via crafted OpenID Connect (OIDC) token CVE-2025-66626 — github.com/argoproj/argo-workflows: argoproj/argo-workflows is vulnerable to RCE via ZipSlip and symbolic links CVE-2025-68156 — github.com/expr-lang/expr: Expr: Denial of Service via uncontrolled recursion in expression evaluation CVE-2025-68476 — github.com/kedacore/keda: KEDA: Arbitrary file read vulnerability in Vault authentication CVE-2025-69223 — aiohttp: AIOHTTP's HTTP Parser auto_decompress feature is vulnerable to zip bomb CVE-2026-21441 — urllib3: urllib3 vulnerable to decompression-bomb safeguard bypass when following HTTP redirects (streaming API) CVE-2026-24049 — wheel: wheel: Privilege Escalation or Arbitrary Code Execution via malicious wheel file unpacking

🎯 Affected products96

  • Red Hat OpenShift AI 2.25
  • registry.redhat.io/rhoai/odh-codeflare-operator-rhel9@sha256:2c98b3b933276dbcead1fde142bfcd3f130d89e6812c6b433da7eed650ae2dbc_amd64 as a component of Red Hat OpenShift AI 2.25
  • registry.redhat.io/rhoai/odh-codeflare-operator-rhel9@sha256:53c79641084ebe6c98274b31e34cc1a759b1443b96cf7dc45317008a30b1fc8d_arm64 as a component of Red Hat OpenShift AI 2.25
  • registry.redhat.io/rhoai/odh-dashboard-rhel9@sha256:4333242b1f6f25f8656bd612870d02868f3724d80cf542c8d78ada49a8ad9cb2_ppc64le as a component of Red Hat OpenShift AI 2.25
  • registry.redhat.io/rhoai/odh-dashboard-rhel9@sha256:4519eccf48b1f2393bab39980fadde7e398cfff1933b78e9565029f95296ff05_arm64 as a component of Red Hat OpenShift AI 2.25
  • registry.redhat.io/rhoai/odh-dashboard-rhel9@sha256:a15b54532e9e06d91abce8fd7becf2aa3bfbce56f231036e25e9ffed15760f74_s390x as a component of Red Hat OpenShift AI 2.25
  • registry.redhat.io/rhoai/odh-dashboard-rhel9@sha256:ce1e29736422aa55f1a3837fc38a365fbc1096d58b6794cca84ff907da273917_amd64 as a component of Red Hat OpenShift AI 2.25
  • registry.redhat.io/rhoai/odh-data-science-pipelines-argo-argoexec-rhel9@sha256:42f631d436d62d7399ca3ef8fd89a334c7839823c8e6ffafe2cdd32ee36493bb_amd64 as a component of Red Hat OpenShift AI 2.25
  • registry.redhat.io/rhoai/odh-data-science-pipelines-argo-argoexec-rhel9@sha256:56615395c62e26f3ef9bd267c0d5245331b8c67508df4bd8bbc83d72c4ef3b99_arm64 as a component of Red Hat OpenShift AI 2.25
  • registry.redhat.io/rhoai/odh-data-science-pipelines-argo-argoexec-rhel9@sha256:84a87320bee17439c05d2c6a1edf3b7e83b2f7ebfdd850399d12635e58da4d55_ppc64le as a component of Red Hat OpenShift AI 2.25
  • registry.redhat.io/rhoai/odh-data-science-pipelines-argo-workflowcontroller-rhel9@sha256:04a821296c01da5155ab36d9381b962866c26e9c7516f321ffe440b7fa13b4c5_amd64 as a component of Red Hat OpenShift AI 2.25
  • registry.redhat.io/rhoai/odh-data-science-pipelines-argo-workflowcontroller-rhel9@sha256:33aaad4cc22d1e2998e4710cc644f4032bec8f140e5236fdc83d520a869626ef_arm64 as a component of Red Hat OpenShift AI 2.25
  • registry.redhat.io/rhoai/odh-data-science-pipelines-argo-workflowcontroller-rhel9@sha256:d2cb739f949dc4ec9617bb9470a8482a8011077043e06e735ab0c9d7d1cac381_ppc64le as a component of Red Hat OpenShift AI 2.25
  • registry.redhat.io/rhoai/odh-data-science-pipelines-operator-controller-rhel9@sha256:12d3d74ffbd7eb3a4817952835ab9bf5b89edf4fc9af661a28ec009f3251a519_arm64 as a component of Red Hat OpenShift AI 2.25
  • registry.redhat.io/rhoai/odh-data-science-pipelines-operator-controller-rhel9@sha256:1fb43684436f6b55152aab553177df048d5bb267c5efbc61f0f27cdbb0848957_ppc64le as a component of Red Hat OpenShift AI 2.25
  • registry.redhat.io/rhoai/odh-data-science-pipelines-operator-controller-rhel9@sha256:c51fe06b557fa20d78af7b12cf6c6ddc3227f44f3957a52f3037c25700cfadb2_amd64 as a component of Red Hat OpenShift AI 2.25
  • registry.redhat.io/rhoai/odh-kf-notebook-controller-rhel9@sha256:1e1d5fad0aecf93b79b21112360aa0c308654c5b5df829cd3144488f8e217af4_ppc64le as a component of Red Hat OpenShift AI 2.25
  • registry.redhat.io/rhoai/odh-kf-notebook-controller-rhel9@sha256:72f613c382aac012e2e79e800df50c210f41693cc2aaa5b99cb28ab38f1966c8_arm64 as a component of Red Hat OpenShift AI 2.25
  • registry.redhat.io/rhoai/odh-kf-notebook-controller-rhel9@sha256:7f027d05df255e62828ab28d5f188655fc125bc4ead872c7a33cedaf47b12f8c_s390x as a component of Red Hat OpenShift AI 2.25
  • registry.redhat.io/rhoai/odh-kf-notebook-controller-rhel9@sha256:cf586b7cb58dff92e7f31b8b9ebe5c971e55c67b8ba2c3320d2b71183c88fc7c_amd64 as a component of Red Hat OpenShift AI 2.25
  • registry.redhat.io/rhoai/odh-kuberay-operator-controller-rhel9@sha256:2df297674884e6ac297bae685f80741489ddf1e1d0ae1d5ec354917dff1acdda_arm64 as a component of Red Hat OpenShift AI 2.25
  • registry.redhat.io/rhoai/odh-kuberay-operator-controller-rhel9@sha256:7af31fef4a2269c2cf444420048ea644c9949714e9a63417fe6d7288abee457b_amd64 as a component of Red Hat OpenShift AI 2.25
  • registry.redhat.io/rhoai/odh-kueue-controller-rhel9@sha256:3ca10a19a0706af65bb590403adad92114810bf0ac64a89d6ac1d862e4cec671_ppc64le as a component of Red Hat OpenShift AI 2.25
  • registry.redhat.io/rhoai/odh-kueue-controller-rhel9@sha256:56a321957afd15d357c8b53fc50299c0811981e8b925e64858dc7c4cfcea1993_s390x as a component of Red Hat OpenShift AI 2.25
  • registry.redhat.io/rhoai/odh-kueue-controller-rhel9@sha256:633bfd24f1396c150b5902407879e7b26e7681074772fbbfeccc4d48cbe77b19_amd64 as a component of Red Hat OpenShift AI 2.25
  • registry.redhat.io/rhoai/odh-kueue-controller-rhel9@sha256:ff09ee957797fa15208f9130e246ae006c385cc799573a71d31aff9ddf0e805d_arm64 as a component of Red Hat OpenShift AI 2.25
  • registry.redhat.io/rhoai/odh-llama-stack-k8s-operator-rhel9@sha256:1d258fe98c2477e4256a9b936f412f2501fb7ca9e3b810347f9712e0d5ce5c92_arm64 as a component of Red Hat OpenShift AI 2.25
  • registry.redhat.io/rhoai/odh-llama-stack-k8s-operator-rhel9@sha256:e8ccea3bfafbde4d5b91cc7b7732b2b64d6aa08499b5ca63b4d8f1e980291351_amd64 as a component of Red Hat OpenShift AI 2.25
  • registry.redhat.io/rhoai/odh-ml-pipelines-api-server-v2-rhel9@sha256:5bd1065dca1978c49c0143e2be4e921465c6a67fa786ab2a9254f0790259096e_ppc64le as a component of Red Hat OpenShift AI 2.25
  • registry.redhat.io/rhoai/odh-ml-pipelines-api-server-v2-rhel9@sha256:8b34aaf5a7729ef1ccd01f2b1b1e3439b304343f3403de67f68255015206fbf4_arm64 as a component of Red Hat OpenShift AI 2.25
  • +66 more not shown

✅ Remediation

For Red Hat OpenShift AI 2.25.2 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this errata update: https://docs.redhat.com/en/documentation/red_hat_openshift_ai/ Workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability. Workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability. Workaround: To mitigate this issue, users should avoid processing untrusted checkpoint files or visiting untrusted web pages with applications utilizing Hugging Face Accelerate. Restricting the sources of input data for affected components can significantly reduce the attack surface. No service restart is required for this operational control. Workaround: Potential mitigations for this issue include: * Using rootless containers, as doing so will block most of the inadvertent writes (runc would run with reduced privileges, making attempts to write to procfs files ineffective). * Based on our analysis, neither AppArmor or SELinux can protect against the full version of the redirected write attack. The container runtime is generally privileged enough to write to arbitrary procfs files, which is more than sufficient to cause a container breakout. Workaround: To mitigate this issue, avoid processing untrusted .designspace files with the fontTools varLib script or any application that invokes fontTools.varLib.main(). Restrict the execution environment of processes handling .designspace files to minimize potential impact from arbitrary file writes. If the fonttools package is not required, consider removing it. Workaround: No mitigation is currently available that meets Red Hat Product Security’s standards for usability, deployment, applicability, or stability. Workaround: To mitigate this issue, applications using the `Expr` library should ensure that evaluation environments do not contain cyclic references. Additionally, externally supplied data structures must be validated or sanitized before being passed to `Expr` for evaluation. As a last-resort defensive measure, expression evaluation can be wrapped with panic recovery to prevent a full process crash.

🔗 References (18)