This security advisory from Red Hat Product Security covers multiple critical vulnerabilities affecting Red Hat OpenShift AI, collectively identified by six CVEs (CVE-2026-2614, CVE-2026-5241, CVE-2026-8643, CVE-2026-33245, CVE-2026-34993, CVE-2026-48710). The advisory announces the release of RHOAI 3.4.2 with updated container images intended to address these issues. The advisory does not specify affected versions or detailed vulnerability descriptions beyond referencing the CVEs and associated CWEs (including CWE-22, CWE-829, CWE-79, CWE-502, CWE-1289). No explicit patch links are provided, but the update to version 3.4.2 is the remediation. The vendor recommends following the official upgrade documentation to apply the errata update properly.

The vulnerabilities are classified as critical, implying potential severe impact on confidentiality, integrity, or availability of Red Hat OpenShift AI deployments. The presence of multiple CWEs suggests risks such as path traversal, improper resource management, cross-site scripting, deserialization issues, and other security weaknesses. However, no known exploits in the wild have been reported at this time.

A fix is available through the upgrade to Red Hat OpenShift AI version 3.4.2. Users should follow the official Red Hat documentation for upgrading their clusters to apply this errata update fully. No additional mitigation steps are specified or required beyond applying the update as per vendor guidance.