Threats Tagged 'cve-2026-16456'

Red Hat OpenShift AI version 3.4.3 addresses multiple security issues identified by CVE-2026-13717 and others. The advisory announces updated images for Red Hat OpenShift AI to mitigate these vulnerabilities. The update is critical and users are advised to upgrade their clusters following Red Hat's official documentation. No specific technical details or exploit information are provided in the advisory.

CVE-2026-16456 is a medium severity vulnerability in the odh-model-controller component of Red Hat OpenShift AI. It allows an authenticated user with permissions to create custom resources to exploit a flaw in the loadSecret function, which improperly reads the Secret namespace from user-controlled input without validation. This can lead to unauthorized disclosure of sensitive API keys and cloud credentials from other namespaces. There are no known exploits in the wild. Red Hat has released updated images for Red Hat OpenShift AI to address this and other vulnerabilities.

A flaw was found in the `odh-model-controller`. An authenticated user with permissions to create custom resources can exploit a vulnerability in the `loadSecret` function. This function improperly reads the Secret namespace from user-controlled input without validation. This allows an attacker to read sensitive API keys and cloud credentials from other namespaces, leading to information disclosure.

A Regular Expression Denial of Service (ReDoS) vulnerability (CVE-2026-15154) was found in guardrails-detectors, a component of Red Hat OpenShift AI. This flaw allows a remote attacker to send specially crafted regular expressions to the public detection API, causing catastrophic backtracking. The result is a worker process consuming 100% CPU indefinitely, leading to denial of service for the guardrails-mediated large language model (LLM) pipeline. The vulnerability affects specific versions of Red Hat OpenShift AI and has a medium severity rating with a CVSS score of 6.5. Updated images and a fixed version 2.25.10 are available from Red Hat to address this issue.