This advisory concerns two security vulnerabilities in Red Hat OpenShift AI, tracked as CVE-2025-10725 and CVE-2025-57852, involving improper access control and authorization weaknesses (CWE-266 and CWE-276). The release of RHOAI 2.19.3 includes updated container images intended to address these issues. The vendor advisory does not specify detailed technical exploitation methods or impacts beyond the general categories of access control and authorization flaws. No CVSS score is assigned, and no known active exploitation has been reported.

The vulnerabilities could allow unauthorized access or improper authorization within Red Hat OpenShift AI environments, potentially leading to privilege escalation or unauthorized actions. However, no active exploitation has been observed, and the exact impact depends on the deployment context and usage of the affected components.

Red Hat has released updated images as part of RHOAI 2.19.3 to address these vulnerabilities. Users should upgrade to Red Hat OpenShift AI 2.19.3 following the official Red Hat documentation and upgrade instructions to fully apply the errata update. Patch status is not explicitly confirmed in the advisory text, but the updated release implies remediation. Check the official Red Hat advisory and documentation for the latest upgrade guidance and confirmation of fixes.