CVE-2025-12805

Katalog CVE

CVSS 8.1 · High EPSS 0,38%

Kerentanan Improper Isolation or Compartmentalization pada redhat openshift ai. Skor CVSS 3.1 8.1 (High) menurut redhat.com.

Deskripsi (NVD)

A flaw was found in Red Hat OpenShift AI (RHOAI) llama-stack-operator. This vulnerability allows unauthorized access to Llama Stack services deployed in other namespaces via direct network requests, because no NetworkPolicy restricts access to the llama-stack service endpoint. As a result, a user in one namespace can access another user’s Llama Stack instance and potentially view or manipulate sensitive data.

Rincian

Terbit di NVD

26 Maret 2026

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

8.1 (High), sumber redhat.com
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-653: Improper Isolation or Compartmentalization

EPSS (30 hari)

0,38% peluang dieksploitasi; lebih tinggi dari 30,4% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://access.redhat.com/errata/RHSA-2026:2106 advisory vendor
• https://access.redhat.com/errata/RHSA-2026:2695 advisory vendor
• https://access.redhat.com/security/cve/CVE-2025-12805 advisory vendor
• https://bugzilla.redhat.com/show_bug.cgi?id=2413101 exploit · issue tracking · advisory vendor