RHSA-2026:53261CriticalCVSS 9.9

Red Hat Security Advisory: RHOAI 2.25.10 - Red Hat OpenShift AI

Published
August 11, 2026
Last Modified
August 19, 2026

🔗 CVE IDs covered (18)

CVE-2026-15581 →CVE-2026-18617 →CVE-2026-18618 →CVE-2026-18950 →CVE-2026-18620 →CVE-2026-18948 →CVE-2026-18947 →CVE-2026-15467 →CVE-2026-16456 →CVE-2026-16745 →CVE-2026-18611 →CVE-2026-18949 →CVE-2026-18982 →CVE-2026-18608 →CVE-2026-18941 →CVE-2026-18621 →CVE-2026-18942 →CVE-2026-15154 →

📋 Description

CVE-2026-15154 — guardrails-detectors: guardrails-detectors: Unauthenticated Regular-Expression Denial of Service (ReDoS) via detector_params.regex CVE-2026-15467 — trustyai-service-operator: trustyai-service-operator: LMEvalJob sidecar containers bypass protected environment variable filtering, allowing TRUST_REMOTE_CODE policy override CVE-2026-15581 — trustyai-service-operator: trustyai-service-operator: TAS internal Service bypasses kube-rbac-proxy, exposing unauthenticated Quarkus API cluster-wide CVE-2026-16456 — odh-model-controller: odh-model-controller: Cross-namespace secret read via NIM Account CRD confused deputy CVE-2026-16745 — odh-dashboard: odh-dashboard: Backend port 8080 trusts x-forwarded-access-token without origin validation CVE-2026-18608 — data-science-pipelines-operator: DSPO: Operator ClusterRole grants pods/exec:*, kubeflow.org /, and ClusterRole/Binding CRUD cluster-wide CVE-2026-18611 — data-science-pipelines-operator: DSPO: Cryptographically weak secret generation (math/rand) for DB and S3 credentials CVE-2026-18617 — data-science-pipelines-operator: DSPO: MySQL DSN parameter injection via CustomExtraParams enables LOCAL INFILE file exfiltration from operator pod CVE-2026-18618 — ml-metdata: Bundled gRPC 1.46.3 (2022) with published HTTP/2 DoS CVEs — directly reachable on listener CVE-2026-18620 — data-sciences-pipeline: User-controlled ServiceAccount for workflow pods without authorization check — confused deputy CVE-2026-18621 — data-sciences-pipeline: DSP: V1 Argo template path accepts arbitrary Workflow spec, bypassing all v2 security hardening CVE-2026-18941 — feast: feast-operator: Feast: Default authentication mode is no_auth — shared multi-tenant instances deployed without authentication CVE-2026-18942 — feast-operator: Feast: feast apply CronJob runs user Python with feature-server SA — tenant code to SA token escalation CVE-2026-18947 — feast: Feast: Authorization bypass in /materialize endpoints enables DoS via unauthorized full re-materialization CVE-2026-18948 — feast: Feast: Unsafe dill deserialization of registry-stored UDFs — RCE on feature server and registry server CVE-2026-18949 — odh-dashboard: odh-dashboard: ClusterRole grants cluster-wide CRUD on secrets and RBAC management resources CVE-2026-18950 — odh-dashboard: odh-dashboard: Confused-deputy privilege escalation via unchecked roleRef in RoleBinding creation CVE-2026-18982 — odh-training-operator-rhel9: RHOAI fork aggregates training job create onto native edit/admin ClusterRoles

🎯 Affected products88

  • Red Hat OpenShift AI 2.25
  • registry.redhat.io/rhoai/odh-built-in-detector-rhel9@sha256:1d4a14dd88adf38e9a0d089ff5fb6f85511bb609b30de50e695cc9031a3de80a_arm64 as a component of Red Hat OpenShift AI 2.25
  • registry.redhat.io/rhoai/odh-built-in-detector-rhel9@sha256:5d55fc5c3111e5ca57fae6e440c078e40a933b2bb17c03bd9656cc4f7b2778fc_ppc64le as a component of Red Hat OpenShift AI 2.25
  • registry.redhat.io/rhoai/odh-built-in-detector-rhel9@sha256:5db776b1ae15a9c8b38f5c40a5d2e123f35966db9f2bdb1de6faa21ee6c3e9ea_s390x as a component of Red Hat OpenShift AI 2.25
  • registry.redhat.io/rhoai/odh-built-in-detector-rhel9@sha256:fcf07f316b252c2d62d8d6a1a739f55ef3ec0b6aa493dc75c6f2900d60666aa7_amd64 as a component of Red Hat OpenShift AI 2.25
  • registry.redhat.io/rhoai/odh-caikit-nlp-rhel9@sha256:1869f66c0cc35c25d68abbeb4812d8589a0012d8e22e04f38d73de83359a650b_arm64 as a component of Red Hat OpenShift AI 2.25
  • registry.redhat.io/rhoai/odh-caikit-nlp-rhel9@sha256:814e967a380ce6065fe2663f2da1d4d2d91e2b9299fe9936347206933e5a57fd_amd64 as a component of Red Hat OpenShift AI 2.25
  • registry.redhat.io/rhoai/odh-dashboard-rhel9@sha256:0acb5fd5218f2e83838b445094a7147ca98ac804a6f9b2c9ed9ad43848a711ff_ppc64le as a component of Red Hat OpenShift AI 2.25
  • registry.redhat.io/rhoai/odh-dashboard-rhel9@sha256:7214df61f824b0b684300df9d157b23c6bbdd20963dd47e5299c159e1cb11223_amd64 as a component of Red Hat OpenShift AI 2.25
  • registry.redhat.io/rhoai/odh-dashboard-rhel9@sha256:93f2f92e14b4538d1307c4700e6e2caa11264c1eec5b23fe2d863e485c1bef5c_s390x as a component of Red Hat OpenShift AI 2.25
  • registry.redhat.io/rhoai/odh-dashboard-rhel9@sha256:f7b3a8d09c0e808b7bd664489239af124746347c069629cf5935a36b2e8c2f68_arm64 as a component of Red Hat OpenShift AI 2.25
  • registry.redhat.io/rhoai/odh-data-science-pipelines-argo-argoexec-rhel9@sha256:00b63ad2a433e41d229d3b9e03aba871e78905e4cf3d69813035a70337295b3d_arm64 as a component of Red Hat OpenShift AI 2.25
  • registry.redhat.io/rhoai/odh-data-science-pipelines-argo-argoexec-rhel9@sha256:5df594da6f16733a3eb0c8b9da9eef449a9bf021aea53f7d94197d236d10ba37_amd64 as a component of Red Hat OpenShift AI 2.25
  • registry.redhat.io/rhoai/odh-data-science-pipelines-argo-argoexec-rhel9@sha256:b86e0851969db3e7ac52583f21eb7824b4cdb7ea32566724b9c140a3d52fb1fe_ppc64le as a component of Red Hat OpenShift AI 2.25
  • registry.redhat.io/rhoai/odh-data-science-pipelines-argo-workflowcontroller-rhel9@sha256:0fed6e6df92eb0f384c74fecbd52cf0b56d5df1076c28f7e873ddd4122d1f1d3_arm64 as a component of Red Hat OpenShift AI 2.25
  • registry.redhat.io/rhoai/odh-data-science-pipelines-argo-workflowcontroller-rhel9@sha256:510acfa831b8bcd4159ca29ee08ec9660f5f0135cc14a9f88e2ce80a1d9a482a_amd64 as a component of Red Hat OpenShift AI 2.25
  • registry.redhat.io/rhoai/odh-data-science-pipelines-argo-workflowcontroller-rhel9@sha256:d1c177c68f728e634b032d0afb6f3ab9cb232d4cee0d39a6687aa7ecd87fbb89_ppc64le as a component of Red Hat OpenShift AI 2.25
  • registry.redhat.io/rhoai/odh-data-science-pipelines-operator-controller-rhel9@sha256:45082ad3797b2c3c3fdf9111b462e5bcbbba077f3450e37831de1f590197239c_ppc64le as a component of Red Hat OpenShift AI 2.25
  • registry.redhat.io/rhoai/odh-data-science-pipelines-operator-controller-rhel9@sha256:761109d79279873a26f72108c0da78901920bfdb3a0fb2a808e1b83f7b61f8c7_amd64 as a component of Red Hat OpenShift AI 2.25
  • registry.redhat.io/rhoai/odh-data-science-pipelines-operator-controller-rhel9@sha256:c76046c03d7ecfed750ceb8a58c5e51f04f0b46b6c8ba473233d1dc54d646b1d_arm64 as a component of Red Hat OpenShift AI 2.25
  • registry.redhat.io/rhoai/odh-feast-operator-rhel9@sha256:49e860c452cbf3bcbebc6dc34e1ebab45d091703c6834e94e15589376c633f25_amd64 as a component of Red Hat OpenShift AI 2.25
  • registry.redhat.io/rhoai/odh-feast-operator-rhel9@sha256:57848cf741934241d3bfa67a381c5b665558ba0c23f1ddf6a039a9f4a7432ec4_arm64 as a component of Red Hat OpenShift AI 2.25
  • registry.redhat.io/rhoai/odh-feast-operator-rhel9@sha256:9f931edb576c5c643364b46336487ab8bac868ebcb305ca7cd0d8d14b0ebb87c_ppc64le as a component of Red Hat OpenShift AI 2.25
  • registry.redhat.io/rhoai/odh-feature-server-rhel9@sha256:c4ed94d9d45d8682a87f68845dff96892a45fa0e2cc84341986e2a7f58303655_ppc64le as a component of Red Hat OpenShift AI 2.25
  • registry.redhat.io/rhoai/odh-feature-server-rhel9@sha256:ec80a875d9ee27568b4c171d430ad0974a4c6d823cf8ee25fad291fc4975bb33_amd64 as a component of Red Hat OpenShift AI 2.25
  • registry.redhat.io/rhoai/odh-feature-server-rhel9@sha256:fca8e754f4e521f7e86a8bcd0c4a513511850ec78471a96f92757cad5bcb8c6d_arm64 as a component of Red Hat OpenShift AI 2.25
  • registry.redhat.io/rhoai/odh-guardrails-detector-huggingface-runtime-rhel9@sha256:7294c55b528e9acefe63acc29400582bf4276549566be1e4c9cc0d8d8336b1d7_ppc64le as a component of Red Hat OpenShift AI 2.25
  • registry.redhat.io/rhoai/odh-guardrails-detector-huggingface-runtime-rhel9@sha256:7d062a83502798b13749989276c51214f451f07e88e1d076f5fea2581750fdf4_amd64 as a component of Red Hat OpenShift AI 2.25
  • registry.redhat.io/rhoai/odh-guardrails-detector-huggingface-runtime-rhel9@sha256:899d2eb30b00005ee91539e050a56eb8330d674286e7e414651a83650525eb7e_s390x as a component of Red Hat OpenShift AI 2.25
  • registry.redhat.io/rhoai/odh-guardrails-detector-huggingface-runtime-rhel9@sha256:a74abf96b322fc56631722798796de4c631ccfcf658c2c733bf5cd9c8c528017_arm64 as a component of Red Hat OpenShift AI 2.25
  • +58 more not shown

✅ Remediation

For Red Hat OpenShift AI 2.25.10 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this errata update: https://docs.redhat.com/en/documentation/red_hat_openshift_ai/ Workaround: To reduce the attack surface, administrators should review and modify the `ClusterRole` associated with the Data Science Pipelines Operator (DSPO) to remove unnecessary permissions. Specifically, restrict or remove permissions for `pods/exec`, `kubeflow.org */*`, `seldondeployments *`, and broad `apiGroups:'*'` for deployments and services. The operator's `ClusterRole` should be limited to only the required resources such as `apps/deployments`, `services`, `secrets`, `configmaps`, `roles/rolebindings`, `routes`, `networkpolicies`, `servicemonitors`, and DSPA/Argo CRDs. Applying these changes may require restarting the DSPO pod for the updated permissions to take effect and could impact operator functionality if not carefully validated. Workaround: To mitigate this issue, users should explicitly provide strong, cryptographically secure credentials for MariaDB and MinIO when deploying the Data Science Pipelines Operator. Additionally, restrict network access to the MinIO and MariaDB services using OpenShift NetworkPolicies to limit exposure. Avoid exposing MinIO via public OpenShift Routes unless absolutely necessary and ensure MariaDB is not configured with an empty root password. Workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability. Workaround: To mitigate this issue, ensure that network policies are strictly enforced to limit access to the MLMD pod's port 8080. Restrict inbound connections to only essential KFP v2 driver pods and other designated DSP components. This measure reduces the attack surface by limiting potential in-cluster attackers who could exploit the gRPC HTTP/2 denial-of-service vulnerabilities. Workaround: To mitigate this issue, operators of Red Hat OpenShift AI should configure an allow-list for ServiceAccounts that tenants can specify in their workflow run requests. Restricting the available ServiceAccounts to a predefined, least-privileged set, such as the default `pipeline-runner` only, will prevent unauthorized privilege escalation. This configuration change should be applied to the API server responsible for processing workflow run requests. New workflow runs will respect the updated configuration. Workaround: To mitigate this issue, ensure that Data Science Project (DSP) namespaces enforce `pod-security.kubernetes.io/enforce: restricted`. Additionally, verify that the `pipeline-runner` ServiceAccount is not bound to `privileged` or `anyuid` Security Context Constraints (SCCs). Workaround: To mitigate this vulnerability, configure Feast deployments to utilize Kubernetes RBAC authentication. Ensure that `FeatureStore` Custom Resources (CRs) explicitly define an authentication mechanism other than `no_auth`. For Feast SDK usage, avoid the `no_auth` setting in production environments unless `FEAST_INSECURE_NO_AUTH=1` is explicitly set, acknowledging the security implications. Applying these configuration changes will require a redeployment or restart of the affected Feast services. Workaround: Configure the Feast operator to use a dedicated, minimally-privileged ServiceAccount for the `feast apply` CronJob, ensuring `automountServiceAccountToken: false` is set. Apply a restricted `securityContext` to the CronJob pod and implement network policies to limit egress to only required registry endpoints. Ensure the CronJob ServiceAccount is separate from the feature-server ServiceAccount. Workaround: To mitigate this vulnerability, restrict network access to the Feast feature server to trusted clients only, using firewall rules or network policies. If the Feast feature server is configured with the default `no_auth` setting, enable Kubernetes/OIDC authentication to require user authentication for access. While enabling authentication will prevent unauthenticated exploitation, any authenticated user will still be able to trigger the denial of service due to the authorization bypass. Workaround: Configure Feast to enforce `auth.type: kubernetes` in the operator-generated configuration and deny registry writes by default. This measure limits the attack surface by requiring proper authentication and authorization for registry modifications, preventing the deserialization of malicious user-defined functions. Workaround: To mitigate this issue, restrict access to the `opendatahub` namespace to limit potential compromise of the dashboard pod. Implement egress `NetworkPolicy` rules to control and restrict outbound network traffic from the dashboard. Additionally, configure audit log alerting to monitor for and detect any unexpected creation of `ClusterRoleBindings` within the cluster. Workaround: To mitigate this issue, restrict access to the OpenShift AI dashboard to only trusted users. Additionally, implement an Open Policy Agent (OPA) or Gatekeeper policy to prevent the creation of RoleBindings that reference privileged ClusterRoles like cluster-admin within user namespaces. Regularly monitor audit logs for any unauthorized RoleBinding creations.

🔗 References (22)