Vulnerabilities of Red Hat Red Hat OpenShift AI (RHOAI)

Is your version affected?

CVE list

CVE	Summary	Score	Published
CVE-2026-42208	Exploited BerriAI LiteLLM SQL Injection Vulnerability	9.3 Critical	May 8, 2026
CVE-2026-41242	protobufjs compiles protobuf definitions into JavaScript (JS) functions	9.4 Critical	Apr 18, 2026
CVE-2026-33805	@fastify/reply-from v12.6.1 and earlier and @fastify/http-proxy v11.4.3 and earlier process the client's Connection…	9.0 Critical	Apr 15, 2026
CVE-2025-14813	: Use of a Broken or Risky Cryptographic Algorithm vulnerability in Legion of the Bouncy Castle Inc	9.3 Critical	Apr 15, 2026
CVE-2026-33815	Memory-safety vulnerability in github.com/jackc/pgx/v5	9.8 Critical	Apr 7, 2026
CVE-2026-33816	Memory-safety vulnerability in github.com/jackc/pgx/v5	9.8 Critical	Apr 7, 2026
CVE-2026-35030	LiteLLM is a proxy server (AI Gateway) to call LLM APIs in OpenAI (or native) format	9.4 Critical	Apr 6, 2026
CVE-2026-0545	In mlflow/mlflow, the FastAPI job endpoints under `/ajax-api/3.0/jobs/*` are not protected by authentication or…	9.1 Critical	Apr 3, 2026
CVE-2026-32871	FastMCP is a Pythonic way to build MCP servers and clients	10.0 Critical	Apr 2, 2026
CVE-2025-15379	A command injection vulnerability exists in MLflow's model serving container initialization code, specifically in the…	10.0 Critical	Mar 30, 2026
CVE-2025-15036	A path traversal vulnerability exists in the `extract_archive_to_dir` function within the…	9.6 Critical	Mar 30, 2026
CVE-2026-33937	Handlebars provides the power necessary to let users build semantic templates	9.8 Critical	Mar 27, 2026
CVE-2026-33211	Tekton Pipelines project provides k8s-style resources for declaring CI/CD-style pipelines	9.6 Critical	Mar 23, 2026
CVE-2026-33186	gRPC-Go is the Go language implementation of gRPC	9.1 Critical	Mar 20, 2026
CVE-2026-27962	Authlib is a Python library which builds OAuth and OpenID Connect servers	9.1 Critical	Mar 16, 2026
CVE-2026-28229	Argo Workflows is an open source container-native workflow engine for orchestrating parallel jobs on Kubernetes	9.8 Critical	Mar 11, 2026
CVE-2026-2635	MLflow Use of Default Password Authentication Bypass Vulnerability	9.8 Critical	Feb 20, 2026
CVE-2025-14009	A critical vulnerability exists in the NLTK downloader component of nltk/nltk, affecting all versions	10.0 Critical	Feb 18, 2026
CVE-2025-69872	DiskCache (python-diskcache) through 5.6.3 uses Python pickle for serialization by default	9.8 Critical	Feb 11, 2026
CVE-2026-1615	Versions of the package jsonpath before 1.3.0 are vulnerable to Arbitrary Code Injection via unsafe evaluation of…	9.8 Critical	Feb 9, 2026
CVE-2026-22778	vLLM is an inference and serving engine for large language models (LLMs)	9.8 Critical	Feb 2, 2026
CVE-2025-61140	The value function in jsonpath 1.1.1 lib/index.js is vulnerable to Prototype Pollution	9.8 Critical	Jan 28, 2026
CVE-2025-61686	React Router is a router for React	9.1 Critical	Jan 10, 2026

Other Red Hat products