The Red Hat security advisory RHSA-2026:28960 announces the release of Red Hat OpenShift AI 2.25.8, which includes fixes for three security vulnerabilities: CVE-2026-35029, CVE-2026-35030, and CVE-2026-42271. These vulnerabilities relate to issues such as improper handling of direct requests, truncation errors, and OS command injection. The advisory provides updated container images for multiple architectures and directs users to official documentation for upgrade instructions. No explicit patch or remediation details are stated in the advisory content. The vulnerabilities have been classified as high severity, but no CVSS scores are provided. There are no reports of active exploitation in the wild.

The vulnerabilities affect Red Hat OpenShift AI and potentially allow attackers to exploit weaknesses related to direct request handling, truncation errors, and OS command injection. These issues could lead to unauthorized actions or command execution within the affected environment. The advisory classifies the severity as high, indicating significant risk if unaddressed. However, no active exploitation has been reported.

Red Hat has released version 2.25.8 of OpenShift AI to address these vulnerabilities. Users should upgrade to this version following the official Red Hat documentation at https://docs.redhat.com/en/documentation/red_hat_openshift_ai/. The advisory does not specify any temporary workarounds or mitigations beyond applying the update. Patch status is not explicitly confirmed in the advisory text; therefore, users should consult the vendor documentation and errata for the latest remediation guidance.