CVE-2026-13717highCWE-284

CVE-2026-13717: fallo de gravedad alta en llm-d

Rhoai maas: llm-d: maas/llm-d inference gateway: default allowedroutes.namespaces.from: all allows namespace users to hijack shared model-serving traffic (tokens, prompts, outputs)

Publicada el · Actualizada el

Seguir esta CVE+ Monitorear Red Hat OpenShift AI+ Monitorear llm-d

Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.

21Vexday Risk Score

Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.

ssvc Trackcvss 8.8epss 0.6%
A flaw was found in the Red Hat OpenShift AI (RHOAI) MaaS Gateway. Improper configuration of the Gateway in a model-serving context allows a standard user with low privileges to intercept, read, log, and alter all MaaS model traffic. This includes sensitive information such as access keys, input prompts, and outputs, leading to significant information disclosure and data tampering.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Productos afectados
llm-dRed Hat · Red Hat OpenShift AI 3.4Red Hat · Red Hat OpenShift AI (RHOAI)
CVEs relacionadas — llm-d

En el mismo producto, de las más peligrosas a las menos.

CVE-2026-23536HIGHFeast: unauthenticated arbitrary file readEPSS 2.5%CVE-2026-33845HIGHGnutls: gnutls: denial of service via dtls zero-length fragmentEPSS 2.1%CVE-2023-52355HIGHLibtiff: tiffrasterscanlinesize64 produce too-big size and could cause oomEPSS 1.8%CVE-2026-42009HIGHGnutls: gnutls: denial of service via dtls packet reordering vulnerabilityEPSS 1.3%CVE-2026-33846HIGHGnutls: gnutls: denial of service via heap buffer overflow in dtls handshake fragment reassemblyEPSS 1.3%CVE-2024-11831MEDIUMNpm-serialize-javascript: cross-site scripting (xss) in serialize-javascriptEPSS 1.1%