CVE-2025-49655VulnerabilityPublished 25 Nov 2025Updated 6 Sep 2026

Red Hat Security Advisory: RHTAS 1.3.1 - Tech Preview Release of Model Transparency

Affects Red HatSource GCVE Database

Not known to be exploited.

Data as of 26 Oct 2026, 06:26 UTC

Severity

High

Rated by Threat Radar · No CVSS score from NVD or the CNA

EPSS: 0.7% chance of exploitation in 30 days – higher than 54% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.

Exploitation evidence

Disclosed: evidence found.
CVE published 25 Nov 2025
Detectable: no evidence on record.
No public nuclei template indexed
Weaponised: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors

A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 2026-10-26.

Disclosed: The CVE record is public on cve.org. Its publication is t = 0.
Detectable: A public nuclei template can find exposed instances, for defenders and attackers alike.
Weaponised: Public exploit code exists in Metasploit or Exploit-DB, or CISA SSVC reports a public proof of concept.
Exploited in the wild: CISA KEV lists it, CISA SSVC rates exploitation active, or a source reports attacks.
Observed by OffSeq Mirage: OffSeq Mirage honeypot sensors recorded attack traffic for this CVE, or found exposed hosts without attack traffic.

Moments are spaced evenly, not to scale; a dashed line marks a gap of six months or more. Deltas count from t = 0. Sources that give only a date (CISA KEV, Exploit-DB, or a time of exactly 00:00Z) read “same day” rather than hours. Metasploit modules carry the flaw’s disclosure date, not their release date, and nuclei templates carry no date, so both appear above but not on the timeline.

What to do

Affected software

Product	Affected	Fixed in
Red Hat Product Security Red Hat	Affected Red Hat Red Hat Trusted Artifact Signer Red Hat Trusted Artifact Signer 1.3 amd64 registry.redhat.io/rhtas/model-transparency-rhel9@sha256:cdbf79af3951e2830df94331a890ab8f1e2649db72e96bec57fee61fc9add1e6_amd64	Fixed in–

AI-suggested

Red Hat currently does not provide a fix or patch for this vulnerability. The vendor states that mitigation options are either unavailable or do not meet their criteria for deployment and stability. Since remote upload of model files is not allowed by default in Red Hat products, this configuration reduces exposure. Users should restrict model file sources to trusted origins and avoid loading untrusted model files. Monitor Red Hat advisories for any future updates or fixes.

Description

The RHTAS Model Transparency CLI image can be used to sign and verify AI/ML workloads

Impact

If exploited, this vulnerability allows an attacker to execute arbitrary code on the system by loading a maliciously crafted AI/ML model file. This can compromise confidentiality, integrity, and availability of the affected system. However, Red Hat products in their default configuration do not permit remote upload of model files, which limits the risk of remote exploitation. There are no known exploits in the wild at this time.

Summary

This vulnerability (CVE-2025-49655) involves unsafe deserialization in the Keras framework's TorchModuleWrapper class due to torch.load() deserializing model data with weights_only set to False, causing fallback to Python's pickle module. Since pickle can execute arbitrary code during deserialization, a malicious model file could lead to arbitrary code execution. Red Hat's advisory notes that their products do not allow remote upload of model files by default, limiting attack vectors. The vulnerability is classified under CWE-502 (Deserialization of Untrusted Data) and has a Red Hat-assigned CVSS v3 score of 8.4 (high severity) with local attack vector, low complexity, no privileges or user interaction required, and high impact on confidentiality, integrity, and availability.

CWE-502Deserialization of Untrusted Data (opens in a new tab)
Base weaknessLikelihood of exploit: MediumCWE Top 25 (2025): #15OWASP Top 10 A08:2025: Software or Data Integrity Failures (opens in a new tab)
The product deserializes untrusted data without sufficiently ensuring that the resulting data will be valid.
Architecture and Design · Implementation
If available, use the signing/sealing features of the programming language to assure that deserialized data has not been tainted. For example, a hash-based message authentication code (HMAC) could be used to ensure that data has not been modified.
Implementation
When deserializing data, populate a new object rather than just deserializing. The result is that the data flows through safe input validation and that the functions are safe.
Implementation
Explicitly define a final object() to prevent deserialization.
OWASP Cheat Sheets
Abuse Case (opens in a new tab)
Deserialization (opens in a new tab)
XML Security (opens in a new tab)
XML External Entity Prevention (opens in a new tab)
Software Supply Chain Security (opens in a new tab)
OWASP ASVS 4.0.3
V1.5.2 (opens in a new tab)
V5.5.3 (opens in a new tab)
V5.5.1 (opens in a new tab)
Attack patterns
Object Injection (opens in a new tab)
From MITRE CWE, MITRE CAPEC and OWASP (Top 10, OpenCRE).

References

Community reviews

Loading reviews…

Exploitation evidence

What to do

Affected software

Description

AI analysisMachine-generated, updated 16 Aug 2026, 18:18 UTC

WeaknessesCWE-502

Technical details

References

Community reviews

Related threats