Loading story…
A critical privilege escalation vulnerability, tracked as CVE-2025-10725, has been identified in Red Hat OpenShift AI Service. This flaw is rated with a CVSS score of 9.9, indicating its severe impact on affected systems. The vulnerability arises from an overly permissive clusterrole configuration, which allows authenticated users, such as data scientists operating standard Jupyter notebooks, to escalate their privileges to that of a full cluster administrator. Exploitation of this flaw enables attackers to gain complete control over the OpenShift AI cluster, compromising its confidentiality, integrity, and availability. Attackers leveraging this vulnerability can steal sensitive data, disrupt all hosted services, and take over the underlying infrastructure. The risk extends to all applications and workloads running on the compromised cluster, potentially leading to widespread operational and data loss. The vulnerability is remotely exploitable, meaning attackers do not require physical access to the environment. Red Hat has acknowledged the issue and released security advisories to inform customers of the risk. The flaw was publicly disclosed on September 30, 2025, and security researchers have emphasized the urgency of patching affected systems. Organizations using Red Hat OpenShift AI are strongly advised to review their clusterrole permissions and apply available patches or mitigations immediately. The vulnerability highlights the importance of least-privilege access controls in containerized and AI-driven environments. Failure to address this issue could result in attackers gaining persistent access to critical infrastructure. The incident underscores the need for continuous monitoring and timely response to privilege escalation threats in cloud-native platforms. Security teams should also audit user roles and permissions to prevent similar misconfigurations in the future. The disclosure has prompted industry-wide discussions on the security of AI and machine learning platforms. Red Hat customers are encouraged to consult official advisories and update their systems without delay to mitigate the risk of exploitation.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
2 events from the most recent confirmed update back to the earliest known activity.
Alongside disclosure, Red Hat published mitigations for affected environments, including removing the binding between the kueue-batch-user-role ClusterRole and the system:authenticated group and enforcing least-privilege access controls. Security reporting urged organizations to patch quickly and investigate for possible prior compromise.
Red Hat disclosed CVE-2025-10725, a privilege-escalation flaw in OpenShift AI caused by an overly permissive ClusterRoleBinding/ClusterRole configuration. The issue could let a minimally authenticated user create jobs in arbitrary namespaces, escalate to cluster-admin, and potentially gain root access across the cluster.
4 references tracked. Mallory keeps watching after this page renders.
go.theregister.com
Open sourcethehackernews.com
Open sourcesecurityonline.info
Open sourcecvefeed.io
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A critical vulnerability (CVE-2025-13888) has been identified in OpenShift GitOps, allowing namespace administrators to escalate privileges and potentially take over entire Kubernetes clusters. The flaw enables authenticated attackers to create ArgoCD Custom Resources (CRs) that manipulate the system into granting elevated permissions in other namespaces, including those with privileged access. By leveraging these permissions, attackers can deploy privileged workloads on master nodes, effectively achieving root access across the cluster. Security advisories highlight that this vulnerability is remotely exploitable and poses a significant risk to organizations using OpenShift GitOps. The issue was disclosed by Red Hat, and while specific affected product versions are not detailed, the vulnerability is rated as critical with a CVSS score of 9.1. Organizations are urged to review their OpenShift GitOps deployments and apply mitigations or patches as recommended by the vendor to prevent potential exploitation and cluster compromise.
Jun 29, 2026
Red Hat disclosed two high-severity vulnerabilities in OpenShift AI that could let authenticated attackers access other tenants’ resources and sensitive Kubernetes credentials. **CVE-2025-12805** affects the `llama-stack-operator`, where a missing `NetworkPolicy` left the Llama Stack service endpoint reachable across namespaces. Red Hat said a user in one namespace could directly access another user’s Llama Stack instance and potentially view or manipulate sensitive data, with the issue tracked under **CWE-653** and rated `CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N`. A second flaw, **CVE-2026-5483**, impacts the `odh-dashboard` component and can expose Kubernetes Service Account tokens through a Node.js endpoint. Red Hat warned that disclosure of those tokens could enable unauthorized access to Kubernetes resources; the issue is mapped to **CWE-201** and carries the vector `CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H`. Red Hat published CVE records, Bugzilla entries, and errata references for both vulnerabilities, highlighting risks to confidentiality and integrity in multi-tenant OpenShift AI deployments.
Jun 29, 2026
Red Hat disclosed **`CVE-2026-73269`**, a critical privilege-escalation flaw in the `cluster-curator-controller` component used by **OpenShift Multicluster Engine for Kubernetes**. The bug allows a tenant with only namespace-level access to create a crafted `ClusterCurator` resource whose `metadata.name` differs from `metadata.namespace`, triggering the controller to create a cluster-scoped `ClusterRoleBinding` and, in some cases, a `RoleBinding` in an arbitrary namespace. Those bindings can attach the tenant’s namespace-local `cluster-installer` service account to the powerful curator role, effectively breaking namespace isolation. Successful exploitation can elevate a local tenant to **cluster-wide privileges**, including access to and manipulation of secrets, management of cluster actions, and deletion of hosted clusters or node pools. The issue carries a **CVSS 3.1 score of 9.9** and affects `multicluster-engine/cluster-curator-controller-rhel9`. Red Hat advised organizations to apply vendor fixes and reduce exposure by restricting creation of `ClusterCurator` resources through RBAC, enforcing matching `metadata.name` and `metadata.namespace` with an admission controller, and reviewing permissions that allow creation of cluster-scoped resources.
Aug 13, 2026