The vulnerability CVE-2026-6859 affects Red Hat Enterprise Linux AI (RHEL AI) 3 through a flaw in the InstructLab component. Specifically, the `linux_train.py` script sets `trust_remote_code=True` when loading models from the HuggingFace Hub, which is an untrusted source. This setting enables execution of arbitrary Python code embedded in the model. An attacker can exploit this by convincing a user to run `ilab train/download/generate` commands with a specially crafted malicious model, resulting in arbitrary code execution and potential full system compromise. The CVSS v3.1 score is 8.8 (high severity), reflecting network attack vector, low attack complexity, no privileges required, user interaction needed, and high impact on confidentiality, integrity, and availability. No patch or official remediation is currently documented in the vendor advisory, and no known exploits in the wild have been reported as of the publication date.

Successful exploitation allows remote attackers to execute arbitrary Python code on the affected system by tricking a user into running commands with a malicious model from the HuggingFace Hub. This can lead to complete system compromise, including full control over confidentiality, integrity, and availability of the system.

Patch status is not yet confirmed — check the Red Hat advisory at https://access.redhat.com/security/cve/CVE-2026-6859 for current remediation guidance. Until an official fix is available, users should avoid running `ilab train/download/generate` commands with models from untrusted sources such as the HuggingFace Hub. Restricting usage to trusted models and exercising caution with user interaction can reduce risk.