CVE-2025-10725 is a privilege escalation vulnerability in Red Hat OpenShift AI Service affecting versions >=2.16.0 and <2.16.3. An authenticated user with low privileges can escalate to cluster administrator by exploiting overly permissive ClusterRole bindings associated with the Kueue component. This allows complete compromise of the cluster, including data theft, service disruption, and control over underlying infrastructure. The vulnerability is classified as CWE-266 (Incorrect Privilege Assignment) and CWE-276. Red Hat has released version 2.16.3 containing fixes and provides documented mitigation steps involving disabling or removing the Kueue component or modifying ClusterRoleBindings to prevent exploitation.

Successful exploitation allows a low-privileged authenticated user to gain full cluster administrator privileges, resulting in total compromise of the cluster's confidentiality, integrity, and availability. This includes the ability to steal sensitive data, disrupt all services, and control the underlying infrastructure and all hosted applications.

Red Hat recommends upgrading to Red Hat OpenShift AI version 2.16.3 to fully remediate this vulnerability. If upgrading is not immediately feasible and Kueue features are not required, the Kueue component can be disabled by setting its management state to "Removed" in the RHOAI DataScienceCluster resource. For versions 2.19 and later, additional mitigations include preventing the RHOAI operator from managing the kueue-batch-user-rolebinding by applying specific annotations and disabling the ClusterRoleBinding by changing its subject to a non-existent group. After applying official fixes, it is recommended to remove the temporary ClusterRoleBinding modifications. Users should follow Red Hat's official documentation and advisories for detailed upgrade and mitigation instructions.