The vulnerability CVE-2025-12805 affects Red Hat OpenShift AI's llama-stack-operator component. It arises because the operator does not implement a NetworkPolicy to restrict network access to the llama-stack service endpoint. Consequently, users in one Kubernetes namespace can send direct network requests to Llama Stack services deployed in other namespaces, bypassing intended isolation. This improper isolation (CWE-653) can lead to unauthorized viewing or manipulation of sensitive data belonging to other users within the same RHOAI instance. Red Hat has assigned a CVSS v3 score of 8.1 (high) reflecting network attack vector, low complexity, low privileges required, no user interaction, unchanged scope, and high confidentiality and integrity impacts. The vendor advisory states no fix is currently available and mitigation options are insufficient per Red Hat's standards.

The vulnerability allows unauthorized cross-namespace access to Llama Stack services, potentially exposing or allowing manipulation of sensitive data belonging to other users within the same Red Hat OpenShift AI deployment. This compromises confidentiality and integrity of data in affected environments. There is no impact on availability reported. No known exploits in the wild have been reported.

Currently, no official fix or patch is available for this vulnerability. Red Hat states that existing mitigation options do not meet their criteria for ease of use, applicability, or stability. Users should monitor Red Hat's advisory and documentation for updates on remediation and follow any recommended upgrade instructions once a fix is released. Customers with a Red Hat Technical Account Manager (TAM) can seek direct guidance. Until a fix is available, consider implementing custom network policies or isolation controls to restrict cross-namespace access where feasible.