CVE-2026-15581highCWE-306

CVE-2026-15581: falha de alta gravidade em Red Hat OpenShift AI 2.25

Trustyai-service-operator: trustyai-service-operator: tas internal service bypasses kube-rbac-proxy, exposing unauthenticated quarkus api cluster-wide

Publicada em · Atualizada em

Seguir esta CVE+ Monitorar Red Hat OpenShift AI

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

21Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 8epss 0.4%
A flaw was found in the TrustyAI Service (TAS) deployment. This vulnerability allows any pod on the cluster network to bypass authentication and directly access the TAS backend API. An attacker can exploit this to read, tamper with, or delete monitoring data and configurations, and inject arbitrary data into the service, potentially disrupting tenant operations.
CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Produtos afetados
Red Hat · Red Hat OpenShift AI 2.25Red Hat · Red Hat OpenShift AI 3.3Red Hat · Red Hat OpenShift AI 3.4Red Hat · Red Hat OpenShift AI 3.5
CVEs relacionadas — Red Hat OpenShift AI 2.25

No mesmo produto, das mais perigosas para as menos.

CVE-2026-33845HIGHGnutls: gnutls: denial of service via dtls zero-length fragmentEPSS 2.1%CVE-2023-52355HIGHLibtiff: tiffrasterscanlinesize64 produce too-big size and could cause oomEPSS 1.8%CVE-2026-42009HIGHGnutls: gnutls: denial of service via dtls packet reordering vulnerabilityEPSS 1.3%CVE-2026-33846HIGHGnutls: gnutls: denial of service via heap buffer overflow in dtls handshake fragment reassemblyEPSS 1.3%CVE-2026-18948CRITICALFeast: feast: unsafe dill deserialization of registry-stored udfs — rce on feature server and registry serverEPSS 1.1%CVE-2026-42010HIGHGnutls: gnutls: authentication bypass via nul character in usernameEPSS 1.1%