RHSA-2026:28960HighCVSS 9.1

Red Hat Security Advisory: RHOAI 2.25.8 - Red Hat OpenShift AI

Published
June 24, 2026
Last Modified
October 9, 2026

🔗 CVE IDs covered (3)

CVE-2026-35029 →CVE-2026-35030 →CVE-2026-42271 →

📋 Description

CVE-2026-35029 — litellm: LiteLLM: Remote code execution and privilege escalation via unrestricted proxy configuration endpoint CVE-2026-35030 — litellm: LiteLLM: Authentication bypass and privilege escalation via OIDC userinfo cache key collision CVE-2026-42271 — litellm: LiteLLM: Authenticated command execution via MCP stdio test endpoints

🎯 Affected products8

  • Red Hat OpenShift AI 2.25
  • registry.redhat.io/rhoai/odh-llama-stack-core-rhel9@sha256:59a4a3dc01e258bdd6aa463c8dbb34e14bd1a8357ef6ae3d4ea9e6c8ce062353_arm64 as a component of Red Hat OpenShift AI 2.25
  • registry.redhat.io/rhoai/odh-llama-stack-core-rhel9@sha256:66cc80e961fe991b063dc51467fa901dce3fb2afc383afed1c596ec432363022_amd64 as a component of Red Hat OpenShift AI 2.25
  • registry.redhat.io/rhoai/odh-operator-bundle@sha256:c0d7ed557a77e880b7d78eb3a87a05cadaf8711eea4e024fece782f5a68edebe_amd64 as a component of Red Hat OpenShift AI 2.25
  • registry.redhat.io/rhoai/odh-rhel9-operator@sha256:1fc8714e90d4b7a9ca8e6d9360f692fee9a764d6e556d5241886dbf116df8902_arm64 as a component of Red Hat OpenShift AI 2.25
  • registry.redhat.io/rhoai/odh-rhel9-operator@sha256:227cecaf494ed3999aee9743b93371bd11eebce31538d34bea239133f473e3dd_s390x as a component of Red Hat OpenShift AI 2.25
  • registry.redhat.io/rhoai/odh-rhel9-operator@sha256:5d74f4badc192e18e4cf8027a2091cf5148f1426e0542bc5d7a5ecaf6dd9cf87_ppc64le as a component of Red Hat OpenShift AI 2.25
  • registry.redhat.io/rhoai/odh-rhel9-operator@sha256:a2362d90bb91fd360fdbfe760206da6a30024cca09b9839bdbfe0573a3e76ace_amd64 as a component of Red Hat OpenShift AI 2.25

✅ Remediation

For Red Hat OpenShift AI 2.25.8 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this errata update: https://docs.redhat.com/en/documentation/red_hat_openshift_ai/ Workaround: Limit network access to the LiteLLM service to trusted networks or hosts only. Implement firewall rules to restrict inbound connections to the LiteLLM service's port, ensuring that only authorized systems can reach the service. This reduces the exposure of the `/config/update` endpoint to unauthorized authenticated users. Workaround: To mitigate this issue, ensure that JWT authentication is not enabled in LiteLLM configurations. The vulnerability only manifests when `enable_jwt_auth` is set to `true`. If JWT authentication is not strictly required, disable it to prevent potential authentication bypass and privilege escalation. If this configuration is changed, a restart of the LiteLLM service may be required for the changes to take effect.

🔗 References (7)