CVE-2026-13717highCWE-284

CVE-2026-13717: falha de alta gravidade em llm-d

Rhoai maas: llm-d: maas/llm-d inference gateway: default allowedroutes.namespaces.from: all allows namespace users to hijack shared model-serving traffic (tokens, prompts, outputs)

Publicada em · Atualizada em

Seguir esta CVE+ Monitorar Red Hat OpenShift AI+ Monitorar llm-d

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

21Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 8.8epss 0.6%
A flaw was found in the Red Hat OpenShift AI (RHOAI) MaaS Gateway. Improper configuration of the Gateway in a model-serving context allows a standard user with low privileges to intercept, read, log, and alter all MaaS model traffic. This includes sensitive information such as access keys, input prompts, and outputs, leading to significant information disclosure and data tampering.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Produtos afetados
llm-dRed Hat · Red Hat OpenShift AI 3.4Red Hat · Red Hat OpenShift AI (RHOAI)
CVEs relacionadas — llm-d

No mesmo produto, das mais perigosas para as menos.

CVE-2026-23536HIGHFeast: unauthenticated arbitrary file readEPSS 2.5%CVE-2026-33845HIGHGnutls: gnutls: denial of service via dtls zero-length fragmentEPSS 2.1%CVE-2023-52355HIGHLibtiff: tiffrasterscanlinesize64 produce too-big size and could cause oomEPSS 1.8%CVE-2026-42009HIGHGnutls: gnutls: denial of service via dtls packet reordering vulnerabilityEPSS 1.3%CVE-2026-33846HIGHGnutls: gnutls: denial of service via heap buffer overflow in dtls handshake fragment reassemblyEPSS 1.3%CVE-2024-11831MEDIUMNpm-serialize-javascript: cross-site scripting (xss) in serialize-javascriptEPSS 1.1%