The Red Hat OpenShift AI product prior to version 2.25.8 contains multiple security vulnerabilities, including CVE-2026-35029, CVE-2026-35030, and CVE-2026-42271. These vulnerabilities relate to improper resource management and command injection issues as indicated by CWE-425 (Direct Request ('Forced Browsing')), CWE-222 (Truncation Error), and CWE-78 (OS Command Injection). The CVSS vector for CVE-2026-35029 indicates network attack vector, low attack complexity, no privileges required, no user interaction, and high impact on confidentiality, integrity, and availability. Red Hat has released updated container images and OpenShift AI version 2.25.8 to remediate these vulnerabilities. The vendor advisory explicitly states updated images are available and provides upgrade instructions. No exploits have been observed in the wild to date.

Successful exploitation of these vulnerabilities could lead to significant compromise of confidentiality, integrity, and availability of the affected OpenShift AI deployments. The CVSS vector indicates high impact on all security properties with low complexity and no user interaction required, increasing the risk if the vulnerabilities are exploited. However, no known exploits have been reported in the wild so far.

Red Hat has released updated OpenShift AI images and version 2.25.8 that address these vulnerabilities. Users should upgrade to Red Hat OpenShift AI 2.25.8 following the official upgrade documentation provided by Red Hat to fully apply the errata update. No other mitigations or workarounds are specified. Patch status is confirmed as fixed in version 2.25.8.