Threats Tagged 'cve-2026-18949'

Red Hat OpenShift AI version 3.4.3 addresses multiple security issues identified by CVE-2026-13717 and others. The advisory announces updated images for Red Hat OpenShift AI to mitigate these vulnerabilities. The update is critical and users are advised to upgrade their clusters following Red Hat's official documentation. No specific technical details or exploit information are provided in the advisory.

A vulnerability in the odh-dashboard component allows an attacker who has compromised the dashboard's Service Account token to exploit overly broad permissions. This flaw enables privilege escalation to cluster-administrator level, access to sensitive cluster-wide credentials and keys, and disruption of multi-tenant isolation. The vulnerability is tracked as CVE-2026-18949 with a high severity score of 8.8. Red Hat has acknowledged the issue in advisories related to Red Hat OpenShift AI but has not yet provided a fix for this specific vulnerability. Users are advised to monitor vendor documentation for upgrade instructions once a patch is released.

A flaw was found in odh-dashboard. This vulnerability allows an attacker, who has compromised the dashboard's Service Account (SA) token, to exploit overly broad permissions granted to the SA. This enables the attacker to escalate their privileges to cluster-administrator level, gain access to sensitive data like credentials and keys across the entire cluster, and disrupt multi-tenant isolation.

A Regular Expression Denial of Service (ReDoS) vulnerability (CVE-2026-15154) was found in guardrails-detectors, a component of Red Hat OpenShift AI. This flaw allows a remote attacker to send specially crafted regular expressions to the public detection API, causing catastrophic backtracking. The result is a worker process consuming 100% CPU indefinitely, leading to denial of service for the guardrails-mediated large language model (LLM) pipeline. The vulnerability affects specific versions of Red Hat OpenShift AI and has a medium severity rating with a CVSS score of 6.5. Updated images and a fixed version 2.25.10 are available from Red Hat to address this issue.