RHSA-2026:3713CriticalCVSS 9.8

Red Hat Security Advisory: RHOAI 3.3 - Red Hat OpenShift AI

Published
March 4, 2026
Last Modified
August 31, 2026

🔗 CVE IDs covered (46)

CVE-2025-12638 →CVE-2025-14922 →CVE-2025-14930 →CVE-2025-62593 →CVE-2025-68156 →CVE-2026-1260 →CVE-2025-6242 →CVE-2025-12816 →CVE-2025-14180 →CVE-2025-14920 →CVE-2025-14921 →CVE-2025-14924 →CVE-2025-14925 →CVE-2025-61729 →CVE-2024-25621 →CVE-2025-66418 →CVE-2025-66471 →CVE-2025-66626 →CVE-2025-67725 →CVE-2025-68476 →CVE-2026-22807 →CVE-2026-24049 →CVE-2025-14927 →CVE-2025-64756 →CVE-2025-66034 →CVE-2025-66416 →CVE-2025-66506 →CVE-2025-69223 →CVE-2025-14926 →CVE-2025-66031 →CVE-2025-66448 →CVE-2025-68665 →CVE-2026-24486 →CVE-2025-14928 →CVE-2025-14929 →CVE-2025-59425 →CVE-2025-61726 →CVE-2025-62164 →CVE-2026-21441 →CVE-2025-48956 →CVE-2025-67726 →CVE-2026-0897 →CVE-2025-15284 →CVE-2025-52881 →CVE-2025-69872 →CVE-2026-22778 →

📋 Description

CVE-2024-25621 — github.com/containerd/containerd: containerd local privilege escalation CVE-2025-6242 — vllm: Server Side request forgery (SSRF) in MediaConnector CVE-2025-12638 — keras: Path Traversal Vulnerability in keras CVE-2025-12816 — node-forge: node-forge: Interpretation conflict vulnerability allows bypassing cryptographic verifications CVE-2025-14180 — php: PHP: Denial of Service via invalid character sequence in PDO PostgreSQL prepared statement CVE-2025-14920 — transformers: code execution when processing a malicious Perceiver model file CVE-2025-14921 — transformers: code execution when processing a malicious Transformer-XL model file CVE-2025-14922 — diffusers: Hugging Face Diffusers: Remote Code Execution via Deserialization of Untrusted Data CVE-2025-14924 — transformers: code execution when processing a malicious megatron_gpt2 model file CVE-2025-14925 — accelerate: Hugging Face Accelerate: Remote Code Execution via Deserialization of Untrusted Data CVE-2025-14926 — transformers: code execution when converting a malicious SEW model checkpoint CVE-2025-14927 — transformers: code execution when converting a malicious SEW-D model checkpoint CVE-2025-14928 — transformers: code execution when converting a malicious HuBERT model checkpoint CVE-2025-14929 — transformers: code execution when processing a malicious X-CLIP model file CVE-2025-14930 — transformers: code execution when processing a malicious GLM4 model file CVE-2025-15284 — qs: qs: Denial of Service via improper input validation in array parsing CVE-2025-48956 — vllm: HTTP header size limit not enforced allows Denial of Service from Unauthenticated requests CVE-2025-52881 — runc: opencontainers/selinux: container escape and denial of service due to arbitrary write gadgets and procfs write redirects CVE-2025-59425 — vllm: Timing Attack in vLLM API Token Verification Leading to Authentication Bypass CVE-2025-61726 — golang: net/url: Memory exhaustion in query parameter parsing in net/url CVE-2025-61729 — crypto/x509: golang: Denial of Service due to excessive resource consumption via crafted certificate CVE-2025-62164 — vllm: VLLM deserialization vulnerability leading to DoS and potential RCE CVE-2025-62593 — ray: Ray is vulnerable to RCE via Safari & Firefox Browsers through DNS Rebinding Attack CVE-2025-64756 — glob: glob: Command Injection Vulnerability via Malicious Filenames CVE-2025-66031 — node-forge: node-forge ASN.1 Unbounded Recursion CVE-2025-66034 — fonttools: fontTools: Arbitrary file write leading to remote code execution via malicious .designspace file CVE-2025-66416 — mcp: DNS Rebinding Protection Disabled by Default in Model Context Protocol Python SDK CVE-2025-66418 — urllib3: urllib3: Unbounded decompression chain leads to resource exhaustion CVE-2025-66448 — vllm: vLLM: Remote Code Execution via malicious model configuration CVE-2025-66471 — urllib3: urllib3 Streaming API improperly handles highly compressed data CVE-2025-66506 — github.com/sigstore/fulcio: Fulcio: Denial of Service via crafted OpenID Connect (OIDC) token CVE-2025-66626 — github.com/argoproj/argo-workflows: argoproj/argo-workflows is vulnerable to RCE via ZipSlip and symbolic links CVE-2025-67725 — tornado: Tornado Quadratic DoS via Repeated Header Coalescing CVE-2025-67726 — tornado: Tornado Quadratic DoS via Crafted Multipart Parameters CVE-2025-68156 — github.com/expr-lang/expr: Expr: Denial of Service via uncontrolled recursion in expression evaluation CVE-2025-68476 — github.com/kedacore/keda: KEDA: Arbitrary file read vulnerability in Vault authentication CVE-2025-68665 — langchain-core: LangChain: Arbitrary Code Execution via Serialization Injection CVE-2025-69223 — aiohttp: AIOHTTP's HTTP Parser auto_decompress feature is vulnerable to zip bomb CVE-2025-69872 — python-diskcache: python-diskcache: Arbitrary code execution via insecure pickle deserialization CVE-2026-0897 — Keras: Keras: Denial of Service via crafted HDF5 weight loading file CVE-2026-1260 — sentencepiece: Sentencepiece: Invalid memory access leading to potential arbitrary code execution via a crafted model file. CVE-2026-21441 — urllib3: urllib3 vulnerable to decompression-bomb safeguard bypass when following HTTP redirects (streaming API) CVE-2026-22778 — vLLM: vLLM: Remote code execution via invalid image processing in the multimodal endpoint. CVE-2026-22807 — vLLM: vLLM: Arbitrary code execution via untrusted model loading CVE-2026-24049 — wheel: wheel: Privilege Escalation or Arbitrary Code Execution via malicious wheel file unpacking CVE-2026-24486 — python-multipart: Python-Multipart: Arbitrary file write via path traversal vulnerability

🎯 Affected products200

  • Red Hat OpenShift AI 3.3
  • registry.redhat.io/rhoai/odh-built-in-detector-rhel9@sha256:0c334fac60120561ee6d0c40b92ce2563ba347c1de69a27665469376ad755359_arm64 as a component of Red Hat OpenShift AI 3.3
  • registry.redhat.io/rhoai/odh-built-in-detector-rhel9@sha256:5edde6c78fd7364448600e6267f7c1980263f9c26acd0d4b389e50d1c61e7d2f_ppc64le as a component of Red Hat OpenShift AI 3.3
  • registry.redhat.io/rhoai/odh-built-in-detector-rhel9@sha256:894f3f6f3b8de4c4a448284d12ac7a8bddecc370d64aa71e02ace54d68778e35_amd64 as a component of Red Hat OpenShift AI 3.3
  • registry.redhat.io/rhoai/odh-built-in-detector-rhel9@sha256:cc0ed599f4081c3104ef9696e5f9492e97d8f73bc26ec76f3019b1712e88ae3d_s390x as a component of Red Hat OpenShift AI 3.3
  • registry.redhat.io/rhoai/odh-cli-rhel9@sha256:5603b74e8048d97eb00b5445206ffa95d7881a1c2e9a859e5977b3bd5b3deec0_amd64 as a component of Red Hat OpenShift AI 3.3
  • registry.redhat.io/rhoai/odh-cli-rhel9@sha256:66311faf33ac9aa00ebb19871aeb559f0d69958cd6a753a3ca6fa59e993c591c_arm64 as a component of Red Hat OpenShift AI 3.3
  • registry.redhat.io/rhoai/odh-dashboard-rhel9@sha256:44c484f8ad059eb57ff8b45a4c551ba068f6673946c7c0dcd5ae0e4b9e1094ad_ppc64le as a component of Red Hat OpenShift AI 3.3
  • registry.redhat.io/rhoai/odh-dashboard-rhel9@sha256:66f05c186fd3dd584fabc3560433553d7e4e167dcc82185bcb676c92e19d33e5_arm64 as a component of Red Hat OpenShift AI 3.3
  • registry.redhat.io/rhoai/odh-dashboard-rhel9@sha256:775b530d43a09a912b6809d19dd908f914a36002ff5a793ae1fc0bf4f8f55402_amd64 as a component of Red Hat OpenShift AI 3.3
  • registry.redhat.io/rhoai/odh-dashboard-rhel9@sha256:cabbd6c56c159334e8ba9479a3f71f27875355ca3ea3cfad1d16daecdfbf3b2b_s390x as a component of Red Hat OpenShift AI 3.3
  • registry.redhat.io/rhoai/odh-data-science-pipelines-argo-argoexec-rhel9@sha256:6fe430b75d6d92cde069a1fab1b6801a9b99b3bf770f6c3d82def37154e0ab24_arm64 as a component of Red Hat OpenShift AI 3.3
  • registry.redhat.io/rhoai/odh-data-science-pipelines-argo-argoexec-rhel9@sha256:718c9e074ac5dfa33721bc69bb3f932b5a106707ceac9e2dfb81db78d57c2f71_amd64 as a component of Red Hat OpenShift AI 3.3
  • registry.redhat.io/rhoai/odh-data-science-pipelines-argo-argoexec-rhel9@sha256:93660141b12c0d6a9a4bbeacda9053f531c3e739a419e288a2c985747c9ab245_ppc64le as a component of Red Hat OpenShift AI 3.3
  • registry.redhat.io/rhoai/odh-data-science-pipelines-argo-workflowcontroller-rhel9@sha256:1433b8a0640daa7cfd48c83802d29b14fc34410786464a9da5ddc7d67d31ab5e_amd64 as a component of Red Hat OpenShift AI 3.3
  • registry.redhat.io/rhoai/odh-data-science-pipelines-argo-workflowcontroller-rhel9@sha256:c012aec019ee94203fbad0d8c3050bdf8425033b4fc7ea9f1c6fbc645a218151_arm64 as a component of Red Hat OpenShift AI 3.3
  • registry.redhat.io/rhoai/odh-data-science-pipelines-argo-workflowcontroller-rhel9@sha256:da59e9d0a9bf018470c7814bbae989843f8b038103052ce3c20a65ad6fe41a44_ppc64le as a component of Red Hat OpenShift AI 3.3
  • registry.redhat.io/rhoai/odh-data-science-pipelines-operator-controller-rhel9@sha256:2e13f1f46f139e30c2a935d53e5533a377a0c675cca3ed69e3ca4755554b3451_arm64 as a component of Red Hat OpenShift AI 3.3
  • registry.redhat.io/rhoai/odh-data-science-pipelines-operator-controller-rhel9@sha256:b0634a6f357d65626cedc80ff2f425ab9d00c402dc6c4f6e698c767660b4b86a_amd64 as a component of Red Hat OpenShift AI 3.3
  • registry.redhat.io/rhoai/odh-data-science-pipelines-operator-controller-rhel9@sha256:c15a9100ab105374d22f305cb3979b9762316c8184e8b038e5ab9f06af681d56_ppc64le as a component of Red Hat OpenShift AI 3.3
  • registry.redhat.io/rhoai/odh-feast-operator-rhel9@sha256:11ae73edee538dc0138819c8e632daec1aead9e3d771800036175fb1858d669a_amd64 as a component of Red Hat OpenShift AI 3.3
  • registry.redhat.io/rhoai/odh-feast-operator-rhel9@sha256:75381bccabd8eb194d546b1d4e63f13e88992265184789ac134dd5943bd18684_arm64 as a component of Red Hat OpenShift AI 3.3
  • registry.redhat.io/rhoai/odh-feast-operator-rhel9@sha256:b03ce277c86aa384149883dda3d56de90b5f7252a81b39b2237fb9455e893290_ppc64le as a component of Red Hat OpenShift AI 3.3
  • registry.redhat.io/rhoai/odh-feature-server-rhel9@sha256:011559df6f6e4ea3ce1fb5733d3ba6678d55c159a8771e6b683abaf23eff64ef_arm64 as a component of Red Hat OpenShift AI 3.3
  • registry.redhat.io/rhoai/odh-feature-server-rhel9@sha256:3d82d3d0650b51cfdfc06314b3f0b74850675eaf618008665fa2faf5ec66373a_amd64 as a component of Red Hat OpenShift AI 3.3
  • registry.redhat.io/rhoai/odh-feature-server-rhel9@sha256:ce24a2e73c8d1dfed5dbb5c361df8cd1eb15b6a5941e18ee6cf1fa3944e47311_ppc64le as a component of Red Hat OpenShift AI 3.3
  • registry.redhat.io/rhoai/odh-fms-guardrails-orchestrator-rhel9@sha256:3dfe5854a98305536163099dcfdf8dfa44a8747b2543290e62229f99f269051a_ppc64le as a component of Red Hat OpenShift AI 3.3
  • registry.redhat.io/rhoai/odh-fms-guardrails-orchestrator-rhel9@sha256:c1a7b92de33a10c6acab41e48bc68345ab6d0e2eeac9980580499ef6bf2787ac_amd64 as a component of Red Hat OpenShift AI 3.3
  • registry.redhat.io/rhoai/odh-fms-guardrails-orchestrator-rhel9@sha256:c25196fa8be3c977511ec4433667350eb6483e3ea69869016fd3e5e5c5eba1de_arm64 as a component of Red Hat OpenShift AI 3.3
  • registry.redhat.io/rhoai/odh-fms-guardrails-orchestrator-rhel9@sha256:eb077f3d39ea9ea018abd36e0bb58e554d8401f69b250ffd3425efbe38ad32e9_s390x as a component of Red Hat OpenShift AI 3.3
  • +170 more not shown

✅ Remediation

For Red Hat OpenShift AI 3.3 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this errata update: https://docs.redhat.com/en/documentation/red_hat_openshift_ai/ Workaround: The system administrator on the host can manually chmod the directories to not have group or world accessible permissions: ``` chmod 700 /var/lib/containerd chmod 700 /run/containerd/io.containerd.grpc.v1.cri chmod 700 /run/containerd/io.containerd.sandbox.controller.v1.shim ``` An alternative mitigation would be to run containerd in rootless mode. Workaround: Red Hat has investigated whether a possible mitigation exists for this issue, and has not been able to identify a practical example. Please update the affected package as soon as possible. Workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability. Workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability. Workaround: No mitigation is currently available that meets Red Hat Product Security’s standards for usability, deployment, applicability, or stability. Workaround: To mitigate this issue, users should avoid processing Perceiver model files from untrusted or unverified sources. Ensure that all Perceiver model files processed by the Hugging Face Transformers library originate from trusted repositories or have been verified for integrity. If that is not possible, consider processing untrusted models within an isolated sandbox environment. Workaround: To mitigate this issue, users should avoid processing Transformer-XL model files from untrusted or unverified sources. Ensure that all Transformer-XL model files processed by the Hugging Face Transformers library originate from trusted repositories or have been verified for integrity. If that is not possible, consider processing untrusted models within an isolated sandbox environment. Workaround: Red Hat has investigated whether a possible mitigation exists for this issue, and has not been able to identify a practical example. Workaround: To mitigate this issue, users should avoid processing megatron_gpt2 model files from untrusted or unverified sources. Ensure that all megatron_gpt2 model files processed by the Hugging Face Transformers library originate from trusted repositories or have been verified for integrity. If that is not possible, consider processing untrusted models within an isolated sandbox environment. Workaround: To mitigate this issue, users should avoid processing untrusted checkpoint files or visiting untrusted web pages with applications utilizing Hugging Face Accelerate. Restricting the sources of input data for affected components can significantly reduce the attack surface. No service restart is required for this operational control. Workaround: To mitigate this issue, users should avoid converting SEW model checkpoints from untrusted or unverified sources. Ensure that all SEW model checkpoints processed by the Hugging Face Transformers library originate from trusted repositories or have been verified for integrity. If that is not possible, consider processing untrusted models within an isolated sandbox environment. Workaround: To mitigate this issue, users should avoid converting SEW-D model checkpoints from untrusted or unverified sources. Ensure that all SEW-D model checkpoints processed by the Hugging Face Transformers library originate from trusted repositories or have been verified for integrity. If that is not possible, consider processing untrusted models within an isolated sandbox environment. Workaround: To mitigate this issue, users should avoid converting HuBERT model checkpoints from untrusted or unverified sources. Ensure that all HuBERT model checkpoints processed by the Hugging Face Transformers library originate from trusted repositories or have been verified for integrity. If that is not possible, consider processing untrusted models within an isolated sandbox environment. Workaround: To mitigate this issue, users should avoid processing X-CLIP model files from untrusted or unverified sources. Ensure that all X-CLIP model files processed by the Hugging Face Transformers library originate from trusted repositories or have been verified for integrity. If that is not possible, consider processing untrusted models within an isolated sandbox environment. Workaround: To mitigate this issue, users should avoid processing GLM4 model files from untrusted or unverified sources. Ensure that all GLM4 model files processed by the Hugging Face Transformers library originate from trusted repositories or have been verified for integrity. If that is not possible, consider processing untrusted models within an isolated sandbox environment. Workaround: Until a fix is available, the risk can be reduced by running vLLM behind a reverse proxy such as Nginx, Envoy, or HAProxy with strict header size limits, ensuring that oversized requests are dropped before reaching the service. Additional safeguards like container or VM resource limits and traffic monitoring can help contain the impact, but upgrading to the patched release remains the definitive solution. Workaround: Potential mitigations for this issue include: * Using rootless containers, as doing so will block most of the inadvertent writes (runc would run with reduced privileges, making attempts to write to procfs files ineffective). * Based on our analysis, neither AppArmor or SELinux can protect against the full version of the redirected write attack. The container runtime is generally privileged enough to write to arbitrary procfs files, which is more than sufficient to cause a container breakout. Workaround: Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability. Workaround: To mitigate this issue, avoid using the `glob` command-line interface with the `-c` or `--cmd` option when processing filenames from untrusted sources. If programmatic use of `glob` is necessary, ensure that filenames are thoroughly sanitized before being passed to commands executed with shell interpretation enabled. Workaround: To mitigate this issue, avoid processing untrusted .designspace files with the fontTools varLib script or any application that invokes fontTools.varLib.main(). Restrict the execution environment of processes handling .designspace files to minimize potential impact from arbitrary file writes. If the fonttools package is not required, consider removing it. Workaround: To mitigate this issue, applications using the `Expr` library should ensure that evaluation environments do not contain cyclic references. Additionally, externally supplied data structures must be validated or sanitized before being passed to `Expr` for evaluation. As a last-resort defensive measure, expression evaluation can be wrapped with panic recovery to prevent a full process crash. Workaround: To mitigate this issue, avoid loading Keras model archives from untrusted sources. If processing untrusted Keras model archives is unavoidable, ensure they are processed within an isolated and resource-constrained environment to limit the impact of potential memory exhaustion attacks. Workaround: To mitigate this issue, ensure that vLLM instances are configured to load models only from trusted and verified repositories. Restrict access to the model repository path to prevent unauthorized modification or introduction of malicious code. Implement strict access controls and inte…

🔗 References (50)