Skip to main content
CVE-2026-97687VulnerabilityPublished

Red Hat Security Advisory: Red Hat AI Base Images 3.0.10 (Spyre)

Affects Red HatSource GCVE Database

0
Compare

Not known to be exploited.

Data as of 13 Nov 2026, 14:48 UTC

Severity
High

Rated by Threat Radar · CVSS not yet scored by NVD

Exploitation evidence

  1. Disclosed: evidence found.

    CVE published 12 Nov 2026

  2. Detectable: no evidence on record.

    No public nuclei template indexed

  3. Weaponized: no evidence on record.

    No public exploit code indexed in Metasploit or Exploit-DB

  4. Exploited in the wild: no evidence on record.

    Not in CISA KEV and no source reports exploitation

  5. Observed by OffSeq Mirage: no evidence on record.

    No attack traffic recorded by OffSeq Mirage sensors

A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 13 Nov 2026.

What to do

AI-suggested

Red Hat advises that default deployments using direct endpoint communication or standard HTTP proxies with CONNECT tunneling are not vulnerable. Users should review their application architectures to identify if they use HTTPS-capable proxies with customized TLS parameters that override proxy verification. If so, consider mitigating exposure by avoiding such configurations or applying any available workarounds from Red Hat. Customers with a Technical Account Manager (TAM) can consult directly for tailored guidance. Monitor Red Hat advisories for future updates or patches.

Description

CVE-2026-97687 is a vulnerability in urllib3 used in Red Hat AI Base Images 3.0.10 (Spyre) that allows a remote network attacker to intercept and modify HTTPS proxy traffic. The flaw arises when TLS settings for the target server overwrite the proxy's TLS configuration, disabling certificate verification on reused connections. This can enable an attacker to impersonate the proxy, monitor or alter traffic, and steal client credentials. The vulnerability requires specialized application architectures using HTTPS-capable proxies with customized TLS parameters that override proxy verification. Default Red Hat deployments using direct endpoint communication or standard HTTP proxies are not affected. No fix is currently available for Red Hat OpenShift AI products.

References

Community reviews

Loading reviews…