Red Hat Security Advisory: RHOAI 2.25.11 - Red Hat OpenShift AI
Affects Red HatSource GCVE Database
Not known to be exploited · CVSS 7.5 High.
Data as of 27 Oct 2026, 06:15 UTC
- EPSS
- 0.4% chance of exploitation in 30 days – higher than 39% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H- Attack Vector
- Network
- Attack Complexity
- Low
- Privileges Required
- None
- User Interaction
- None
- Scope
- Unchanged
- Confidentiality
- None
- Integrity
- None
- Availability
- High
Bold values are the worst case: easiest to exploit or largest impact.
- Attack Vector: Network
- The vulnerable component is bound to the network stack and the set of possible attackers extends beyond the other options listed, up to and including the entire Internet. Such a vulnerability is often termed 'remotely exploitable' and can be thought of as an attack being exploitable at the protocol level one or more network hops away (e.g., across one or more routers).
- Attack Complexity: Low
- Specialized access conditions or extenuating circumstances do not exist. An attacker can expect repeatable success against the vulnerable component.
- Privileges Required: None
- The attacker is unauthorized prior to attack, and therefore does not require any access to settings or files to carry out an attack.
- User Interaction: None
- The vulnerable system can be exploited without any interaction from any user.
- Scope: Unchanged
- An exploited vulnerability can only affect resources managed by the same security authority. In this case, the vulnerable component and the impacted component are either the same, or both are managed by the same security authority.
- Confidentiality: None
- There is no loss of confidentiality within the impacted component.
- Integrity: None
- There is no loss of integrity within the impacted component.
- Availability: High
- There is total loss of availability, resulting in the attacker being able to fully deny access to resources in the impacted component; this loss is either sustained (while the attacker continues to deliver the attack) or persistent (the condition persists even after the attack has completed). Alternatively, the attacker has the ability to deny some availability, but the loss of availability presents a direct, serious consequence to the impacted component (e.g., the attacker cannot disrupt existing connections, but can prevent new connections; the attacker can repeatedly exploit a vulnerability that, in each instance of a successful attack, leaks a only small amount of memory, but after repeated exploitation causes a service to become completely unavailable).
Definitions: FIRST CVSS v3.1 specification.
Exploitation evidence
Disclosed: evidence found.
CVE published 2 Dec 2025
Detectable: no evidence on record.
No public nuclei template indexed
Weaponised: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors
A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 26 Oct 2026.
- Disclosed
- The CVE record is public on cve.org. Its publication is t = 0.
- Detectable
- A public nuclei template can find exposed instances, for defenders and attackers alike.
- Weaponised
- Public exploit code exists in Metasploit or Exploit-DB, or CISA SSVC or the CVSS exploit maturity reports a public proof of concept.
- Exploited in the wild
- CISA KEV lists it, CISA SSVC rates exploitation active, or a source reports attacks.
- Observed by OffSeq Mirage
- OffSeq Mirage honeypot sensors recorded attack traffic for this CVE, or found exposed hosts without attack traffic.
Moments are spaced evenly, not to scale; a dashed line marks a gap of six months or more. Deltas count from t = 0. Sources that give only a date (CISA KEV, Exploit-DB, or a time of exactly 00:00Z) read “same day” rather than hours. Metasploit modules carry the flaw’s disclosure date, not their release date, and nuclei templates carry no date, so both appear above but not on the timeline.
What to do
Affected software
| Product | Affected | Fixed in |
|---|---|---|
Gogithub.com/golang/go/src/crypto/x509pkg:golang/github.com/golang/go/src/crypto/x509Other threats | Affected
| Fixed in– |
Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.
AI-suggested
Users should upgrade to Red Hat OpenShift AI version 2.25.11 following the official Red Hat documentation to fully apply the security updates. The vendor manages remediation through this updated release. No additional mitigation steps are specified in the advisory.
Description
Red Hat OpenShift AI (RHOAI) version 2.25.11 was released with updates addressing multiple security issues. The advisory references a large set of CVEs, including CVE-2025-61729, but does not specify individual vulnerability details or fixed versions. The update is classified as important and is intended to be applied to OpenShift AI clusters following vendor instructions.
Impact
The advisory classifies the update as important and assigns a high severity level to the vulnerabilities addressed. However, no specific impact details for CVE-2025-61729 or other CVEs are provided. There are no known exploits in the wild for these vulnerabilities at the time of publication.
Summary
The Red Hat Security Advisory RHSA-2026:65126 announces the release of RHOAI 2.25.11 for Red Hat OpenShift AI. This release addresses numerous security vulnerabilities, including CVE-2025-61729 among many others. The advisory does not detail the specific nature of these vulnerabilities or their impacts but indicates that updated container images are available and that cluster upgrades should follow the official documentation.
- CWE-1050Excessive Platform Resource Consumption within a Loop (opens in a new tab)
Base weakness
The product has a loop body or loop condition that contains a control element that directly or indirectly consumes platform resources, e.g. messaging, sessions, locks, or file descriptors.
- OWASP Cheat Sheets
- OWASP ASVS 4.0.3
From MITRE CWE, MITRE CAPEC and OWASP (Top 10, OpenCRE).
- CWE-22Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (opens in a new tab)
Base weaknessLikelihood of exploit: HighCWE Top 25 (2025): #6OWASP Top 10 A01:2025: Broken Access Control (opens in a new tab)
The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.
Implementation · Input Validation
Assume all input is malicious. Use an "accept known good" input validation strategy, i.e., use a list of acceptable inputs that strictly conform to specifications. Reject any input that does not strictly conform to specifications, or transform it into something that does.
Architecture and Design
For any security checks that are performed on the client side, ensure that these checks are duplicated on the server side, in order to avoid CWE-602. Attackers can bypass the client-side checks by modifying values after the checks have been performed, or by changing the client to remove the client-side checks…
Implementation · Input Validation
Inputs should be decoded and canonicalized to the application's current internal representation before being validated (CWE-180). Make sure that the application does not decode the same input twice (CWE-174).
- OWASP Cheat Sheets
- OWASP ASVS 4.0.3
- Attack patterns
- Path Traversal (opens in a new tab)
- Using Slashes and URL Encoding Combined to Bypass Validation Logic (opens in a new tab)
- Manipulating Web Input to File System Calls (opens in a new tab)
- Using Escaped Slashes in Alternate Encoding (opens in a new tab)
- Using Slashes in Alternate Encoding (opens in a new tab)
From MITRE CWE, MITRE CAPEC and OWASP (Top 10, OpenCRE).
- CWE-1333Inefficient Regular Expression Complexity (opens in a new tab)
Base weaknessLikelihood of exploit: High
The product uses a regular expression with a worst-case computational complexity that is inefficient and possibly exponential.
Architecture and Design
Use regular expressions that do not support backtracking, e.g. by removing nested quantifiers.
System Configuration
Set backtracking limits in the configuration of the regular expression implementation, such as PHP's pcre.backtrack_limit. Also consider limits on execution time for the process.
Implementation
Do not use regular expressions with untrusted input. If regular expressions must be used, avoid using backtracking in the expression.
- OWASP Cheat Sheets
- OWASP ASVS 4.0.3
- Attack patterns
From MITRE CWE, MITRE CAPEC and OWASP (Top 10, OpenCRE).
- CWE-940Improper Verification of Source of a Communication Channel (opens in a new tab)
Base weaknessOWASP Top 10 A07:2025: Authentication Failures (opens in a new tab)
The product establishes a communication channel to handle an incoming request that has been initiated by an actor, but it does not properly verify that the request is coming from the expected origin.
Architecture and Design
Use a mechanism that can validate the identity of the source, such as a certificate, and validate the integrity of data to ensure that it cannot be modified in transit using an Adversary-in-the-Middle (AITM) attack.
- OWASP Cheat Sheets
- OWASP ASVS 4.0.3
From MITRE CWE, MITRE CAPEC and OWASP (Top 10, OpenCRE).
- CWE-770Allocation of Resources Without Limits or Throttling (opens in a new tab)
Base weaknessLikelihood of exploit: HighCWE Top 25 (2025): #25
The product allocates a reusable resource or group of resources on behalf of an actor without imposing any intended restrictions on the size or number of resources that can be allocated.
Requirements
Clearly specify the minimum and maximum expectations for capabilities, and dictate which behaviors are acceptable when resource allocation reaches limits.
Architecture and Design
Limit the amount of resources that are accessible to unprivileged users. Set per-user limits for resources. Allow the system administrator to define these limits. Be careful to avoid CWE-410.
Architecture and Design
Design throttling mechanisms into the system architecture. The best protection is to limit the amount of resources that an unauthorized user can cause to be expended.
- OWASP Cheat Sheets
From MITRE CWE, MITRE CAPEC and OWASP (Top 10, OpenCRE).
- CWE-295Improper Certificate Validation (opens in a new tab)
Base weaknessOWASP Top 10 A07:2025: Authentication Failures (opens in a new tab)
The product does not validate, or incorrectly validates, a certificate.
Architecture and Design · Implementation
Certificates should be carefully managed and checked to assure that data are encrypted with the intended owner's public key.
Implementation
If certificate pinning is being used, ensure that all relevant properties of the certificate are fully validated before the certificate is pinned, including the hostname.
- OWASP Cheat Sheets
From MITRE CWE, MITRE CAPEC and OWASP (Top 10, OpenCRE).
- CWE-346Origin Validation Error (opens in a new tab)
Class weaknessOWASP Top 10 A07:2025: Authentication Failures (opens in a new tab)
The product does not properly verify that the source of data or communication is valid.
- OWASP Cheat Sheets
From MITRE CWE, MITRE CAPEC and OWASP (Top 10, OpenCRE).
- CWE-918Server-Side Request Forgery (SSRF) (opens in a new tab)
Base weaknessCWE Top 25 (2025): #22OWASP Top 10 A01:2025: Broken Access Control (opens in a new tab)
The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.
- OWASP Cheat Sheets
- OWASP ASVS 4.0.3
- Attack patterns
From MITRE CWE, MITRE CAPEC and OWASP (Top 10, OpenCRE).
- CWE-306Missing Authentication for Critical Function (opens in a new tab)
Base weaknessLikelihood of exploit: HighCWE Top 25 (2025): #21OWASP Top 10 A07:2025: Authentication Failures (opens in a new tab)
The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.
Architecture and Design
Divide the software into anonymous, normal, privileged, and administrative areas. Identify which of these areas require a proven user identity, and use a centralized authentication capability.
Architecture and Design
For any security checks that are performed on the client side, ensure that these checks are duplicated on the server side, in order to avoid CWE-602. Attackers can bypass the client-side checks by modifying values after the checks have been performed, or by changing the client to remove the client-side checks…
Architecture and Design
Where possible, avoid implementing custom, "grow-your-own" authentication routines and consider using authentication capabilities as provided by the surrounding framework, operating system, or environment.
- OWASP Cheat Sheets
From MITRE CWE, MITRE CAPEC and OWASP (Top 10, OpenCRE).
- CWE-250Execution with Unnecessary Privileges (opens in a new tab)
Base weaknessLikelihood of exploit: Medium
The product performs an operation at a privilege level that is higher than the minimum level required, which creates new weaknesses or amplifies the consequences of other weaknesses.
Architecture and Design · Operation · Environment Hardening
Run your code using the lowest privileges that are required to accomplish the necessary tasks. If possible, create isolated accounts with limited privileges that are only used for a single task. That way, a successful attack will not immediately give the attacker access to the rest of the software or its environment.
Architecture and Design · Separation of Privilege
Identify the functionality that requires additional privileges, such as access to privileged operating system resources. Wrap and centralize this functionality if possible, and isolate the privileged code as much as possible from other code.
Architecture and Design · Attack Surface Reduction
Identify the functionality that requires additional privileges, such as access to privileged operating system resources. Wrap and centralize this functionality if possible, and isolate the privileged code as much as possible from other code.
- OWASP Cheat Sheets
From MITRE CWE, MITRE CAPEC and OWASP (Top 10, OpenCRE).
- CWE-338Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG) (opens in a new tab)
Base weaknessLikelihood of exploit: MediumOWASP Top 10 A04:2025: Cryptographic Failures (opens in a new tab)
The product uses a Pseudo-Random Number Generator (PRNG) in a security context, but the PRNG's algorithm is not cryptographically strong.
Implementation
Use functions or hardware which use a hardware-based random number generation for all crypto. This is the recommended solution. Use CyptGenRandom on Windows, or hw_rand() on Linux.
- OWASP Cheat Sheets
From MITRE CWE, MITRE CAPEC and OWASP (Top 10, OpenCRE).
- CWE-915Improperly Controlled Modification of Dynamically-Determined Object Attributes (opens in a new tab)
Base weaknessOWASP Top 10 A08:2025: Software or Data Integrity Failures (opens in a new tab)
The product receives input from an upstream component that specifies multiple attributes, properties, or fields that are to be initialized or updated in an object, but it does not properly control which attributes can be modified.
Implementation
If available, use features of the language or framework that allow specification of allowlists of attributes or fields that are allowed to be modified. If possible, prefer allowlists over denylists.
Architecture and Design · Implementation
If available, use the signing/sealing features of the programming language to assure that deserialized data has not been tainted. For example, a hash-based message authentication code (HMAC) could be used to ensure that data has not been modified.
Implementation · Input Validation
For any externally-influenced input, check the input against an allowlist of internal object attributes or fields that are allowed to be modified.
- OWASP Cheat Sheets
- OWASP ASVS 4.0.3
From MITRE CWE, MITRE CAPEC and OWASP (Top 10, OpenCRE).
- CWE-639Authorization Bypass Through User-Controlled Key (opens in a new tab)
Base weaknessLikelihood of exploit: HighCWE Top 25 (2025): #24OWASP Top 10 A01:2025: Broken Access Control (opens in a new tab)
The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.
Architecture and Design
For each and every data access, ensure that the user has sufficient privilege to access the record that is being requested.
Architecture and Design · Implementation
Make sure that the key that is used in the lookup of a specific user's record is not controllable externally by the user or that any tampering can be detected.
Architecture and Design
Use encryption in order to make it more difficult to guess other legitimate values of the key or associate a digital signature with the key so that the server can verify that there has been no tampering.
- OWASP Cheat Sheets
From MITRE CWE, MITRE CAPEC and OWASP (Top 10, OpenCRE).
- CWE-266Incorrect Privilege Assignment (opens in a new tab)
Base weaknessOWASP Top 10 A06:2025: Insecure Design (opens in a new tab)
A product incorrectly assigns a privilege to a particular actor, creating an unintended sphere of control for that actor.
Architecture and Design · Operation
Very carefully manage the setting, management, and handling of privileges. Explicitly manage trust zones in the software.
Architecture and Design · Operation · Environment Hardening
Run your code using the lowest privileges that are required to accomplish the necessary tasks. If possible, create isolated accounts with limited privileges that are only used for a single task. That way, a successful attack will not immediately give the attacker access to the rest of the software or its environment.
- OWASP Cheat Sheets
From MITRE CWE, MITRE CAPEC and OWASP (Top 10, OpenCRE).
- CWE-79Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (opens in a new tab)
Base weaknessLikelihood of exploit: HighCWE Top 25 (2025): #1OWASP Top 10 A05:2025: Injection (opens in a new tab)
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Architecture and Design · Libraries or Frameworks
Use a vetted library or framework that does not allow this weakness to occur or provides constructs that make this weakness easier to avoid.
Implementation · Architecture and Design
Understand the context in which your data will be used and the encoding that will be expected. This is especially important when transmitting data between different components, or when generating outputs that can contain multiple encodings at the same time, such as web pages or multi-part mail messages.
Architecture and Design · Implementation · Attack Surface Reduction
Understand all the potential areas where untrusted inputs can enter your software: parameters or arguments, cookies, anything read from the network, environment variables, reverse DNS lookups, query results, request headers, URL components, e-mail, files, filenames, databases, and any external systems that provide…
- OWASP Cheat Sheets
- OWASP ASVS 4.0.3
From MITRE CWE, MITRE CAPEC and OWASP (Top 10, OpenCRE).
- CWE-835Loop with Unreachable Exit Condition ('Infinite Loop') (opens in a new tab)
Base weakness
The product contains an iteration or loop with an exit condition that cannot be reached, i.e., an infinite loop.
- CWE-764Multiple Locks of a Critical Resource (opens in a new tab)
Base weakness
The product locks a critical resource more times than intended, leading to an unexpected state in the system.
Implementation
When locking and unlocking a resource, try to be sure that all control paths through the code in which the resource is locked one or more times correspond to exactly as many unlocks.
From MITRE CWE, MITRE CAPEC and OWASP (Top 10, OpenCRE).
- CWE-1289Improper Validation of Unsafe Equivalence in Input (opens in a new tab)
Base weakness
The product receives an input value that is used as a resource identifier or other type of reference, but it does not validate or incorrectly validates that the input is equivalent to a potentially-unsafe value.
Implementation · Input Validation
Assume all input is malicious. Use an "accept known good" input validation strategy, i.e., use a list of acceptable inputs that strictly conform to specifications. Reject any input that does not strictly conform to specifications, or transform it into something that does.
- OWASP Cheat Sheets
From MITRE CWE, MITRE CAPEC and OWASP (Top 10, OpenCRE).
- CWE-1341Multiple Releases of Same Resource or Handle (opens in a new tab)
Base weakness
The product attempts to close or release a resource or handle more than once, without any successful open between the close operations.
Implementation
Change the code's logic so that the resource is only closed once. This might require simplifying or refactoring. This fix can be simple to do in small code blocks, but more difficult when multiple closes are buried within complex conditionals.
Implementation · Refactoring
It can be effective to implement a flag that is (1) set when the resource is opened, (2) cleared when it is closed, and (3) checked before closing. This approach can be useful when there are disparate cases in which closes must be performed.
Implementation · Refactoring
When closing a resource, set the resource's associated variable to NULL or equivalent value for the given language. Some APIs will ignore this null value without causing errors.
From MITRE CWE, MITRE CAPEC and OWASP (Top 10, OpenCRE).
- CWE-606Unchecked Input for Loop Condition (opens in a new tab)
Base weakness
The product does not properly check inputs that are used for loop conditions, potentially leading to a denial of service or other consequences because of excessive looping.
Implementation
Do not use user-controlled data for loop conditions.
Implementation
Perform input validation.
- OWASP Cheat Sheets
From MITRE CWE, MITRE CAPEC and OWASP (Top 10, OpenCRE).
- CWE-444Name not in the CWE catalogue (opens in a new tab)
- CWE-88Name not in the CWE catalogue (opens in a new tab)
- CWE-1284Name not in the CWE catalogue (opens in a new tab)
- CWE-476Name not in the CWE catalogue (opens in a new tab)
- CWE-409Name not in the CWE catalogue (opens in a new tab)
- CWE-212Name not in the CWE catalogue (opens in a new tab)
- CWE-502Name not in the CWE catalogue (opens in a new tab)
- CWE-93Name not in the CWE catalogue (opens in a new tab)
- CWE-1286Name not in the CWE catalogue (opens in a new tab)
- CWE-1287Name not in the CWE catalogue (opens in a new tab)
- CWE-201Name not in the CWE catalogue (opens in a new tab)
- CWE-805Name not in the CWE catalogue (opens in a new tab)
- CWE-824Name not in the CWE catalogue (opens in a new tab)
- CWE-617Name not in the CWE catalogue (opens in a new tab)
- CWE-772Name not in the CWE catalogue (opens in a new tab)
- CWE-347Name not in the CWE catalogue (opens in a new tab)
- CWE-807Name not in the CWE catalogue (opens in a new tab)
- CWE-911Name not in the CWE catalogue (opens in a new tab)
- CWE-776Name not in the CWE catalogue (opens in a new tab)
- CWE-787Name not in the CWE catalogue (opens in a new tab)
- CWE-214Name not in the CWE catalogue (opens in a new tab)
- CWE-78Name not in the CWE catalogue (opens in a new tab)
- CWE-1389Name not in the CWE catalogue (opens in a new tab)
- CWE-125Name not in the CWE catalogue (opens in a new tab)
- CWE-914Name not in the CWE catalogue (opens in a new tab)
- CWE-414Name not in the CWE catalogue (opens in a new tab)
- GCVE source
- db.gcve.eu
- Csaf Category
- csaf_security_advisory
- Csaf Version
- 2.0
- Publisher
- Red Hat Product Security
- Advisory ID
- RHSA-2026:65126
- Vendor Severity
- high
- CVE Count
- 117
- Additional Cves
- CVE-2025-67030, CVE-2026-4926, CVE-2026-6734, CVE-2026-9563, CVE-2026-9697, CVE-2026-12151, CVE-2026-12243, CVE-2026-13149, CVE-2026-15075, CVE-2026-15154, CVE-2026-15378, CVE-2026-15581, CVE-2026-16745, CVE-2026-18608, CVE-2026-18611, CVE-2026-18617, CVE-2026-18620, CVE-2026-18621, CVE-2026-25681, CVE-2026-26996, CVE-2026-27136, CVE-2026-27904, CVE-2026-30922, CVE-2026-32283, CVE-2026-33231, CVE-2026-33810, CVE-2026-33811, CVE-2026-33814, CVE-2026-33870, CVE-2026-33871, CVE-2026-34445, CVE-2026-35536, CVE-2026-39821, CVE-2026-39829, CVE-2026-39835, CVE-2026-40171, CVE-2026-40192, CVE-2026-40895, CVE-2026-41178, CVE-2026-42027, CVE-2026-42215, CVE-2026-42284, CVE-2026-42338, CVE-2026-42502, CVE-2026-42508, CVE-2026-42578, CVE-2026-42579, CVE-2026-42581, CVE-2026-42583, CVE-2026-42584, CVE-2026-42587, CVE-2026-44240, CVE-2026-44244, CVE-2026-44249, CVE-2026-44431, CVE-2026-44893, CVE-2026-45112, CVE-2026-45416, CVE-2026-45623, CVE-2026-45674, CVE-2026-45736, CVE-2026-45819, CVE-2026-47691, CVE-2026-48043, CVE-2026-48059, CVE-2026-48586, CVE-2026-48779, CVE-2026-49978, CVE-2026-50010, CVE-2026-50193, CVE-2026-53550, CVE-2026-54293, CVE-2026-54512, CVE-2026-55685, CVE-2026-55831, CVE-2026-55833, CVE-2026-55851, CVE-2026-56745, CVE-2026-56746, CVE-2026-56819, CVE-2026-56853, CVE-2026-56858, CVE-2026-56859, CVE-2026-56860, CVE-2026-56862, CVE-2026-59869, CVE-2026-59873, CVE-2026-59874, CVE-2026-59885, CVE-2026-59899, CVE-2026-66036, CVE-2026-66039, CVE-2026-67313, CVE-2026-67320, CVE-2026-67322, CVE-2026-67323, CVE-2026-67324, CVE-2026-67325, CVE-2026-68494, CVE-2026-69112, CVE-2026-69152, CVE-2026-69192, CVE-2026-69243, CVE-2026-69244, CVE-2026-71281, CVE-2026-73088, CVE-2026-73089, CVE-2026-73415, CVE-2026-73417, CVE-2026-73566, CVE-2026-73622, CVE-2026-73623, CVE-2026-73624, CVE-2026-73625, CVE-2026-73627, CVE-2026-73643
References
- access.redhat.com/errata/RHSA-2026:65126 (opens in a new tab)
- access.redhat.com/security/cve/CVE-2025-61729 (opens in a new tab)
- access.redhat.com/security/cve/CVE-2025-67030 (opens in a new tab)
- access.redhat.com/security/cve/CVE-2026-12151 (opens in a new tab)
- access.redhat.com/security/cve/CVE-2026-12243 (opens in a new tab)
- access.redhat.com/security/cve/CVE-2026-13149 (opens in a new tab)
- access.redhat.com/security/cve/CVE-2026-15075 (opens in a new tab)
- access.redhat.com/security/cve/CVE-2026-15154 (opens in a new tab)
- access.redhat.com/security/cve/CVE-2026-15378 (opens in a new tab)
- access.redhat.com/security/cve/CVE-2026-15581 (opens in a new tab)
- access.redhat.com/security/cve/CVE-2026-16745 (opens in a new tab)
- access.redhat.com/security/cve/CVE-2026-18608 (opens in a new tab)
- access.redhat.com/security/cve/CVE-2026-18611 (opens in a new tab)
- access.redhat.com/security/cve/CVE-2026-18617 (opens in a new tab)
- access.redhat.com/security/cve/CVE-2026-18620 (opens in a new tab)
- access.redhat.com/security/cve/CVE-2026-18621 (opens in a new tab)
- access.redhat.com/security/cve/CVE-2026-25681 (opens in a new tab)
- access.redhat.com/security/cve/CVE-2026-26996 (opens in a new tab)
- access.redhat.com/security/cve/CVE-2026-27136 (opens in a new tab)
- access.redhat.com/security/cve/CVE-2026-27904 (opens in a new tab)
Community reviews
Related threats
- Red Hat Security Advisory: Red Hat Developer Hub 1.5.1 releaseHighVulnerability
- Red Hat Security Advisory: Red Hat OpenShift Data Foundation 4.14.18 Bug Fix UpdateHighVulnerability
- Red Hat Security Advisory: RHOAI 2.16.0 - Red Hat OpenShift AIHighVulnerability
- Red Hat Security Advisory: RHOAI 2.16.0 - Red Hat OpenShift AIHighVulnerability
- Red Hat Security Advisory: OpenShift Container Platform 4.12.75 packages and security updateHighVulnerability