Vulnerabilities of Red Hat Red Hat OpenShift AI (RHOAI)
Is your version affected?
CVE list
| CVE | Summary | Score | Published |
|---|---|---|---|
| CVE-2026-83494 | Training-operator: pytorchjob validateupdate casts oldjob from newobj, bypassing managedby immutability (asvs v5.1.3; upstream bug) | Not rated | Nov 6, 2026 |
| CVE-2026-83493 | Distributed-workloads: github actions pinned by mutable tag/branch, including third-party snyk/actions/setup@master | Not rated | Nov 6, 2026 |
| CVE-2026-107912 | Io.quarkus/quarkus-vertx-http: quarkus-vertx-http: authorization bypass in management interface via path concatenation flaw | 7.7 High | Nov 5, 2026 |
| CVE-2026-120194 | Json-glib: json-glib: infinite loop in json_path_query() with negative jsonpath slice step | 7.5 High | Oct 31, 2026 |
| CVE-2026-117574 | A flaw was found in ai-gateway-payload-processing | 9.1 Critical | Oct 28, 2026 |
| CVE-2026-13451 | A flaw was found in KServe | 7.7 High | Oct 28, 2026 |
| CVE-2026-114406 | Ca-certificates: distrust emudhra intermediate ca certificates due to security concerns | 6.8 Medium | Oct 21, 2026 |
| CVE-2026-114236 | storage/pkg/archive.ApplyLayer and ApplyUncompressedLayer may, when processing corrupt or malicious inputs, leak a… | 3.3 Low | Oct 21, 2026 |
| CVE-2026-17557 | A flaw was found in the `lm-evaluation-harness` component of Red Hat OpenShift AI | 6.5 Medium | Oct 21, 2026 |
| CVE-2026-108334 | Github.com/kuadrant/kuadrant-operator/internal/wasm: github.com/rh-api-management/rhcl-operator-product-build/kuadrant-operator: kuadrant-operator: crafted httproute match values can bypass gateway policy overrides | 7.4 High | Oct 15, 2026 |
| CVE-2026-102010 | Gcc-toolset-15-gcc: gcc: gcc-toolset-16: gcc: denial of service via use-after-free in binary heap erase_if | 7.0 High | Sep 28, 2026 |
| CVE-2026-96889 | Librsvg: use-after-free when xml includes have duplicated entities | 7.8 High | Sep 23, 2026 |
| CVE-2026-87743 | A flaw was found in Quarkus HTTP security | 7.5 High | Sep 18, 2026 |
| CVE-2026-92925 | Redis: redis: out-of-bounds read via crafted cluster bus packets | 7.1 High | Sep 17, 2026 |
| CVE-2026-92091 | Jwcrypto: jwcrypto: denial of service via o(n^2) duplicate check on unbounded jwk key_ops array | 5.9 Medium | Sep 16, 2026 |
| CVE-2026-74860 | Libxml2: double-free/uaf in libxml2 python bindings | 8.5 High | Sep 8, 2026 |
| CVE-2026-86332 | A flaw was found in odh-dashboard in Red Hat OpenShift AI | 6.5 Medium | Sep 7, 2026 |
| CVE-2026-84185 | Jwcrypto: jwcrypto: general json jws kid binding bypass during jwkset verification | 5.9 Medium | Sep 3, 2026 |
| CVE-2026-18393 | A flaw was found in FFmpeg | 5.4 Medium | Aug 28, 2026 |
| CVE-2026-80179 | Jwcrypto: jwcrypto: denial of service via malformed jwe tokens | 5.9 Medium | Aug 27, 2026 |
| CVE-2026-43961 | Vim: vimscript injection via unescaped filename in netrw s:netrwmarkfile() filter() expression allows arbitrary code execution | 7.8 High | Aug 19, 2026 |
| CVE-2026-15218 | A flaw was found in the maas-api and maas-controller ServiceAccounts within Red Hat OpenShift AI | 7.9 High | Aug 17, 2026 |
| CVE-2026-18620 | A flaw was found in Data Science Pipelines | 7.1 High | Aug 10, 2026 |
| CVE-2026-18618 | A flaw was found in ml-metadata | 7.5 High | Aug 10, 2026 |
| CVE-2026-18611 | A flaw was found in the Data Science Pipelines Operator | 7.5 High | Aug 10, 2026 |
Other Red Hat products
Red Hat Enterprise Linux 9 1864
Red Hat Enterprise Linux 8 1838
Red Hat Enterprise Linux 7 1501
Red Hat Enterprise Linux 10 1454
Red Hat Enterprise Linux 6 1339
Red Hat OpenShift Container Platform 4 629
Red Hat Enterprise Linux 9.6 Extended Update Support 504
Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions 475
Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support 473
Red Hat Enterprise Linux 10.0 Extended Update Support 461
Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support 451
Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions 433