← Vulnerability feed

Vulnerability record · CVE-2025-12805 · published 26 March 2026

CVE-2025-12805: Redhat openshift ai vulnerability

Redhat · Openshift Ai

A flaw was found in Red Hat OpenShift AI (RHOAI) llama-stack-operator. This vulnerability allows unauthorized access to Llama Stack services deployed in other namespaces via direct network requests, because no NetworkPolicy restricts access to the llama-stack service endpoint. As a result, a user in one namespace can access another user’s Llama Stack instance and potentially view or manipulate sensitive data.

8.1 CVSS 3.1 High EPSS 0.38% · top 70.3% CWE-653 · CWE-653
8.1CVSS 3.1 base score
0.38%EPSS exploitation probability, 30 days
NoNot in CISA KEV
1Affected product versions listed by NVD
4References, 1 tagged exploit
17 Jun 2026Last modified by NVD

Description

A flaw was found in Red Hat OpenShift AI (RHOAI) llama-stack-operator. This vulnerability allows unauthorized access to Llama Stack services deployed in other namespaces via direct network requests, because no NetworkPolicy restricts access to the llama-stack service endpoint. As a result, a user in one namespace can access another user’s Llama Stack instance and potentially view or manipulate sensitive data.

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
https://access.redhat.com/errata/RHSA-2026:2106 Vendor Advisory
https://access.redhat.com/errata/RHSA-2026:2695 Vendor Advisory
https://access.redhat.com/security/cve/CVE-2025-12805 Vendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2413101 ExploitIssue TrackingVendor Advisory

Track CVE-2025-12805 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

8.7CVE-2026-42271LiteLLM MCP test endpoints allow authenticated OS command injectionLiteLLM versions 1.74.2 through before 1.83.7 expose two MCP preview endpoints (POST /mcp-rest/test/connection and POST /mcp-rest/test/tools/list) th…KEVEPSS 13%analysed6.5CVE-2026-48710Starlette Host header validation flaw enables request.url path mismatchStarlette before 1.0.1 did not validate the HTTP Host header before using it to rebuild request.url, so a malformed Host value could make request.url…KEVEPSS 7.1%analysed9.9CVE-2026-5483Redhat openshift ai vulnerabilityA flaw was found in odh-dashboard in Red Hat Openshift AI. This vulnerability in the `odh-dashboard` component of Red Hat OpenShift AI (RHOAI) allows…EPSS 0.65%8.8CVE-2024-7557Redhat openshift ai vulnerabilityA vulnerability was found in OpenShift AI that allows for authentication bypass and privilege escalation across models within the same namespace. Whe…EPSS 0.93%8.7CVE-2023-54365Traefik uncontrolled resource consumption vulnerabilityTraefik before 2.10.5 and 3.0.0-beta4 is affected by a denial-of-service vulnerability in HTTP/2 request handling inherited from the Go standard libr…EPSS 0.77%7.8CVE-2026-1462Keras deserialization of untrusted data vulnerabilityA vulnerability in the `TFSMLayer` class of the `keras` package, version 3.13.0, allows attacker-controlled TensorFlow SavedModels to be loaded durin…EPSS 0.40%7.5CVE-2026-46625Js-cookie javascript cookie prototype pollution vulnerabilityJavaScript Cookie is a JavaScript API for handling cookies, client-side. Prior to version 3.0.7, js-cookie's internal assign() helper copies properti…EPSS 0.99%6.5CVE-2026-15154Redhat openshift ai inefficient regular expression (redos) vulnerabilityA flaw was found in `guardrails-detectors`, a component of Red Hat OpenShift AI. This vulnerability, known as Regular Expression Denial of Service (R…EPSS 0.46%

Source: NIST National Vulnerability Database (record CVE-2025-12805), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.