Threats Tagged 'cve-2026-22807'

Red Hat OpenShift AI 3. 3 has a critical security advisory (RHSA-2026:3713) addressing multiple vulnerabilities including CVE-2024-25621 and 45 additional CVEs. The advisory announces updated images for Red Hat OpenShift AI 3. 3 but does not specify individual vulnerability details or fixes. No explicit patch links or direct fixes are provided in the advisory content. Users are directed to Red Hat documentation for upgrade instructions to apply the errata update. The advisory covers a broad range of CWEs indicating diverse vulnerability types. There are no known exploits in the wild reported at this time.

Red Hat OpenShift AI version 3. 3. 3 addresses multiple critical security vulnerabilities identified by CVE-2025-6242 and 45 additional CVEs. The advisory announces updated container images for Red Hat OpenShift AI to mitigate these issues. No specific technical details or fixes for individual CVEs are provided in the advisory content. There are no known exploits in the wild at the time of publication. The vendor has released updated images and documentation to guide users on upgrading their clusters to apply the errata update. Patch status is not explicitly confirmed in the advisory, and no direct patch links are provided. Users should consult the official Red Hat documentation for upgrade instructions and remediation details. The vulnerabilities collectively are rated critical in severity.

CVE-2026-22807 is a high-severity code injection vulnerability in the vLLM inference engine for large language models, affecting versions 0. 10. 1 up to but not including 0. 14. 0. The flaw arises because vLLM loads Hugging Face auto_map dynamic modules during model resolution without verifying the trustworthiness of remote code, allowing attacker-controlled Python code execution at server startup. Exploitation requires the attacker to influence the model repository or path, either locally or remotely, and does not require API access or prior authentication. This vulnerability enables arbitrary code execution with full privileges on the host system before any request handling occurs. Although no known exploits are currently reported in the wild, the CVSS score of 8. 8 reflects the critical impact on confidentiality, integrity, and availability.

HighVulnerabilityGermanyFranceNetherlands+7#cve#cve-2026-22807#cwe-94