Skip to contentRed Hat Openshift Ai (rhoai) vulnerabilities
- red hat openshift ai (rhoai)Trainer: trainer: trainjob env passthrough enables valuefrom.secretkeyref injection for namespace secret exfiltrationCVE-2026-83495No score
- red hat openshift ai (rhoai)Training-operator: pytorchjob validateupdate casts oldjob from newobj, bypassing managedby immutability (asvs v5.1.3; upstream bug)CVE-2026-83494No score
- red hat openshift ai (rhoai)Distributed-workloads: github actions pinned by mutable tag/branch, including third-party snyk/actions/setup@masterCVE-2026-834939.1 Critical
- red hat exploit intelligence, openshift serverless, build of apache camel 4 for quarkus 3 +7 more +9 moreIo.quarkus/quarkus-vertx-http: quarkus-vertx-http: authorization bypass in management interface via path concatenation flawCVE-2026-1079127.7 High
- red hat enterprise linux 10, enterprise linux 7, enterprise linux 8 +4 more +6 moreJson-glib: json-glib: infinite loop in json_path_query() with negative jsonpath slice stepCVE-2026-1201947.5 High
- red hat enterprise linux 10, enterprise linux 6, enterprise linux 7 +6 more +8 moreGcc: out-of-bounds read in std::from_charsCVE-2026-1154563.7 Low
- red hat enterprise linux 10, enterprise linux 6, enterprise linux 7 +6 more +8 moreGcc: integer wrap in `stdCVE-2026-114691Fix available5.9 Medium
- red hat enterprise linux 10, enterprise linux 6, enterprise linux 7 +6 more +8 moreGcc: confirmed out-of-bounds read/write in libstdc++ parallel `stdCVE-2026-114690Fix available6.2 Medium
- red hat openshift ai (rhoai)Ai-gateway-payload-processing: ai-gateway-payload-processing: tenant/credential selection from client-controlled url path with no in-process authorizationCVE-2026-1175749.1 Critical
- red hat openshift ai (rhoai)Kserve: kserve: server-side request forgery via malicious storageuriCVE-2026-134517.7 High
- red hat agentic cluster security suite 0.2, cost management 4, advanced cluster security for kubernetes 4.11 +55 more +57 moreCa-certificates: distrust emudhra intermediate ca certificates due to security concernsCVE-2026-114406Fix available6.8 Medium
- red hat confidential compute attestation, dpu kit for nvidia, exploit intelligence +18 more +20 morePodman: goroutine/file-descriptor leak in storage/pkg/archive.applylayer and applyuncompressedlayer on malformed layersCVE-2026-1142363.3 Low
- red hat openshift ai (rhoai)Lm-evaluation-harness: lm-evaluation-harness: ssrf via job-spec model.url with bearer credential forwardingCVE-2026-175576.5 Medium
- red hat enterprise linux 10, enterprise linux 8, enterprise linux 9 +4 more +6 moreLibmodulemd: libmodulemd: out-of-bounds read when emitting rpm-map artifactsCVE-2026-92824Fix available6.2 Medium
- red hat enterprise linux 10, enterprise linux 8, enterprise linux 9 +4 more +6 moreLibmodulemd: libmodulemd: missing decompressed-size limit when parsing compressed yamlCVE-2026-928236.2 Medium
- red hat enterprise linux 10, enterprise linux 8, enterprise linux 9 +4 more +6 moreLibmodulemd: libmodulemd: unbounded recursion when parsing nested xmd yamlCVE-2026-928226.2 Medium
- red hat enterprise linux 10, enterprise linux 6, enterprise linux 7 +4 more +6 moreLibarchive: libarchive: use-after-free via aliased mac metadata copyCVE-2026-17591Fix available3.6 Low
- red hat enterprise linux 10, enterprise linux 6, enterprise linux 7 +6 more +8 moreLibtirpc: libtirpc: denial of service via unbounded memory allocation during portmapper response decodingCVE-2026-85977Fix available5.3 Medium
- red hat enterprise linux 10, enterprise linux 6, enterprise linux 7 +6 more +8 moreLibtirpc: libtirpc: denial of service via unbounded memory allocation during rpcsec_gss decodingCVE-2026-852316.5 Medium
- red hat connectivity link 1, connectivity link 1.4, connectivity link 1.5 +1 more +3 moreGithub.com/kuadrant/kuadrant-operator/internal/wasm: github.com/rh-api-management/rhcl-operator-product-build/kuadrant-operator: kuadrant-operator: crafted httproute match values can bypass gateway po…CVE-2026-1083347.4 High
- red hat enterprise linux 10, enterprise linux 6, enterprise linux 7 +6 more +8 moreCyrus-sasl: heap buffer overflow in cyrus-sasl add_to_challenge() allows malicious server to crash or compromise digest-md5 clientsCVE-2026-107161Fix available7.5 High
- red hat enterprise linux 10, enterprise linux 6, enterprise linux 7 +4 more +6 moreRpm: heap-based buffer overflow write in hex2binv() via a mistyped rpmtag_filesignatures header tagCVE-2026-103242Fix available7.1 High
- red hat enterprise linux 10, enterprise linux 6, enterprise linux 7 +4 more +6 moreRpm: rpm: integer overflow in iterreadarchivenext() leads to heap-based buffer overflow when parsing untrusted rpm packagesCVE-2026-955207.1 High
- red hat enterprise linux 10, enterprise linux 10.2 extended update support, enterprise linux 6 +8 more +10 moreGcc-toolset-15-gcc: gcc: gcc-toolset-16: gcc: denial of service via use-after-free in binary heap erase_ifCVE-2026-102010Fix available7.0 High
- red hat enterprise linux 10, enterprise linux 6, enterprise linux 7 +4 more +6 moreRpm: rpm: shell command injection via macro expansion of source/spec file basenames when installing a source rpmCVE-2026-955217.8 High
- red hat enterprise linux 10, enterprise linux 6, enterprise linux 7 +4 more +6 moreRpm: code execution via macro expansion of manifest entries in `rpmgi` (`-q -p` / verify manifest flows)CVE-2026-95519Fix available7.8 High
- red hat enterprise linux 10, enterprise linux 10.0 extended update support, enterprise linux 6 +17 more +19 moreLibrsvg: use-after-free when xml includes have duplicated entitiesCVE-2026-96889Public exploitFix available7.8 High
- red hat enterprise linux 10, enterprise linux 6, enterprise linux 7 +7 more +9 moreGcc: libstdc++ integer overflow in `new` operatorCVE-2026-95619Fix available7.7 High
- red hat exploit intelligence, openshift serverless, build of apache camel 4 for quarkus 3 +8 more +10 moreQuarkus-vertx-http: authorization bypass via path normalization discrepancy in quarkus http securityCVE-2026-877437.5 High
- red hat ansible automation platform 2, enterprise linux 10, enterprise linux 7 +5 more +7 moreJwcrypto: jwcrypto: denial of service via o(n^2) duplicate check on unbounded jwk key_ops arrayCVE-2026-92091Fix available5.9 Medium
- red hat enterprise linux 10, enterprise linux 6, enterprise linux 7 +4 more +6 moreEnvironment-modules: command injection in environment-modules bash completion via malicious module names containing shell metacharactersCVE-2026-85013Fix available7.3 High
- red hat cert manager support for red hat openshift release 1.20, cost management on-premise 1, enterprise linux 10 +22 more +24 moreLibxml2: double-free/uaf in libxml2 python bindingsCVE-2026-74860Fix available8.5 High
- red hat enterprise linux 10, enterprise linux 6, enterprise linux 7 +6 more +8 moreGlib2: toctou symlink race in `g_file_create_replace_destination` fallback pathCVE-2026-864695.3 Medium
- red hat openshift ai (rhoai), openshift ai 2.25, openshift ai 3.5 +2 moreOdh-dashboard: odh-dashboard: nim credential secret readable by any authenticated userCVE-2026-863326.5 Medium
- red hat ansible automation platform 2, enterprise linux 10, enterprise linux 7 +4 more +6 moreJwcrypto: jwcrypto: general json jws kid binding bypass during jwkset verificationCVE-2026-841855.9 Medium
- red hat enterprise linux 10, enterprise linux 6, enterprise linux 7 +4 more +6 moreRpm: command injection in `rpmbuild -t*` (`gettarspec`) via unescaped tarball pathCVE-2026-84837Fix available7.8 High
- red hat enterprise linux 10, enterprise linux 7, enterprise linux 8 +7 more +9 moreLibsolv: libsolv: out-of-bounds write in repo_write() via unvalidated directory id from vertical/paged .solv filelist dataCVE-2026-82327Fix available5.5 Medium
- red hat enterprise linux ai (rhel ai) 3, openshift ai (rhoai) +1 moreFfmpeg: ffmpeg: heap buffer overflow in tdsc_load_cursor() via cur_fmt_mono cursorCVE-2026-18393Fix available5.4 Medium
- red hat ansible automation platform 2, enterprise linux 10, enterprise linux 9 +2 more +4 moreJwcrypto: jwcrypto: denial of service via malformed jwe tokensCVE-2026-801795.9 Medium
- red hat enterprise linux 10, enterprise linux 6, enterprise linux 7 +4 more +6 moreRpm: rpmbuild gettarspec() crafted tar member name → macro injectionCVE-2026-78367Fix available7.0 High
- rpm-software-management popt, red hat enterprise linux 10, enterprise linux 6 +7 more +9 morePopt-devel: popt-static: short realloc in poptconfigfiletostringCVE-2026-18743Fix available2.5 Low
- red hat enterprise linux 10, enterprise linux 6, enterprise linux 7 +8 more +10 moreBinutils: binutils: multiple use-after-free in add_archive_element via lto plugin processingCVE-2026-19548Fix available5.5 Medium
- red hat openshift ai (rhoai), openshift ai 2.25, openshift ai 3.3 +1 more +3 moreOdh-dashboard: odh-dashboard: confused-deputy privilege escalation via unchecked roleref in rolebinding creationCVE-2026-189508.8 High
- red hat openshift ai (rhoai), openshift ai 2.25, openshift ai 3.3 +1 more +3 moreFeast: feast: unsafe dill deserialization of registry-stored udfs — rce on feature server and registry serverCVE-2026-18948Fix available9.9 Critical
- red hat openshift ai (rhoai), openshift ai 2.25, openshift ai 3.3 +1 more +3 moreFeast: feast: authorization bypass in /materialize endpoints enables dos via unauthorized full re-materializationCVE-2026-189478.5 High
- red hat openshift ai (rhoai), openshift ai 2.25, openshift ai 3.4 +2 moreFeast-operator: feast: feast apply cronjob runs user python with feature-server sa — tenant code to sa token escalationCVE-2026-189425.5 Medium
- red hat openshift ai (rhoai), openshift ai 2.25, openshift ai 3.3 +1 more +3 moreFeast: feast-operator: feast: default authentication mode is no_auth — shared multi-tenant instances deployed without authenticationCVE-2026-189417.7 High
- red hat openshift ai (rhoai), openshift ai 3.4 +1 moreMaas-billing: maas api: privilege escalation via forged http headers due to missing authenticationCVE-2026-144509.9 Critical
- red hat openshift ai (rhoai), openshift ai 3.4 +1 moreRhoai maas: llm-d: maas/llm-d inference gateway: default allowedroutes.namespaces.from: all allows namespace users to hijack shared model-serving traffic (tokens, prompts, outputs)CVE-2026-137178.8 High
- rpm-software-management popt, red hat enterprise linux 10, enterprise linux 6 +7 more +9 morePopt-devel: popt-static: size_t underflow in singleoptionhelpCVE-2026-18839Fix available2.2 Low
- Show moreLoading…