CVE-2025-12103mediumCWE-266

CVE-2025-12103: medium-severity vulnerability in Red Hat OpenShift AI 2.25

Openshift-ai: trusty ai grants all authenticated users to list pods in any namespace

Published · Updated

Follow this CVE+ Monitor Red Hat OpenShift AI

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

13Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 5epss 0.3%
A flaw was found in Red Hat Openshift AI Service. The TrustyAI component is granting all service accounts and users on a cluster permissions to get, list, watch any pod in any namespace on the cluster. TrustyAI is creating a role `trustyai-service-operator-lmeval-user-role` and a CRB `trustyai-service-operator-default-lmeval-user-rolebinding` which is being applied to `system:authenticated` making it so that every single user or service account can get a list of pods running in any namespace on the cluster Additionally users can access all `persistentvolumeclaims` and `lmevaljobs`
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N
Affected products
Red Hat · Red Hat OpenShift AI 2.25Red Hat · Red Hat OpenShift AI 3.0Red Hat · Red Hat OpenShift AI (RHOAI)
Related CVEs — Red Hat OpenShift AI 2.25

In the same product, most dangerous first.

CVE-2026-23536HIGHFeast: unauthenticated arbitrary file readEPSS 2.4%CVE-2023-52355HIGHLibtiff: tiffrasterscanlinesize64 produce too-big size and could cause oomEPSS 1.8%CVE-2024-11831MEDIUMNpm-serialize-javascript: cross-site scripting (xss) in serialize-javascriptEPSS 1.1%CVE-2026-18948CRITICALFeast: feast: unsafe dill deserialization of registry-stored udfs — rce on feature server and registry serverEPSS 1.1%CVE-2026-23537CRITICALFeast: unauthenticated arbitrary file writeEPSS 1.0%CVE-2026-0603HIGHOrg.hibernate/hibernate-core: hibernate: information disclosure and data deletion via second-order sql injectionEPSS 1.0%