This advisory covers the RHTAS Model Transparency CLI image, a containerized command-line tool for signing and verifying AI/ML workloads against a private Red Hat Trusted Artifact Signer instance. It references six CVEs including CVE-2025-12638 but does not provide detailed vulnerability descriptions or exploitation information. The advisory does not mention any available fixes or patches for these vulnerabilities. The product is in tech preview release and is used to create signatures and attestations for model artifacts, validating them at build or deploy time using enterprise trust material such as Fulcio/Rekor.

The vulnerabilities affect the Red Hat Trusted Artifact Signer Model Transparency CLI image, potentially impacting the integrity and verification of AI/ML workload signatures. The advisory categorizes the severity as high but does not specify the exact impact or exploitation scenarios. No known exploits are reported in the wild. Without available patches, affected deployments may be at risk of issues related to the referenced CWEs (CWE-22: Path Traversal, CWE-770: Allocation of Resources Without Limits or Throttling, CWE-409: Improper Synchronization).

No official fixes or patches are currently available for these vulnerabilities. Users should monitor the Red Hat advisory RHSA-2026:4271 and related product documentation for updates. Since this is a tech preview release, cautious use in production environments is advised. Follow Red Hat's guidance and update to fixed versions once they are released. Refer to the official product documentation for usage instructions and any interim mitigation recommendations.