The vulnerability CVE-2025-12805 in Red Hat OpenShift AI 2.25 involves improper isolation or compartmentalization within the llama-stack-operator component. Specifically, the absence of NetworkPolicy restrictions on the llama-stack service endpoint permits users in one Kubernetes namespace to send direct network requests to Llama Stack services in other namespaces. This lack of network segmentation breaks namespace isolation, potentially exposing sensitive data or allowing unauthorized manipulation of another user's Llama Stack instance. The CVSS v3.1 score is 8.1 (high severity), reflecting network attack vector, low attack complexity, required privileges, no user interaction, and high confidentiality and integrity impacts. Red Hat has released updated container images in RHOAI 2.25.2 and advises upgrading clusters following their documentation. The vendor advisory notes no direct code fixes but implies mitigation through updated images and configuration guidance.

Successful exploitation allows an attacker with privileges in one Kubernetes namespace to bypass network isolation controls and access Llama Stack services in other namespaces. This can lead to unauthorized disclosure and modification of sensitive data managed by those services. The vulnerability does not affect availability. There are no known public exploits currently. The impact is rated high due to the potential confidentiality and integrity breaches across namespace boundaries in a multi-tenant environment.

Red Hat has released updated container images as part of RHOAI 2.25.2. While no direct code fixes are included, users should upgrade to this version and carefully follow Red Hat's official upgrade and configuration instructions to fully apply the errata and mitigate the vulnerability. Applying appropriate NetworkPolicy configurations to restrict cross-namespace access to the llama-stack service endpoint is critical. Patch status is confirmed via the vendor advisory. No additional urgent actions are indicated beyond upgrading and applying the recommended configuration changes.