Loading vulnerability…
CVE-2025-10725 is a privilege escalation vulnerability in Red Hat OpenShift AI Service that allows a low-privileged authenticated user to obtain full cluster-administrator privileges. The flaw is attributed to incorrect privilege assignment in the platform's RBAC configuration. Available reporting indicates that the ClusterRole kueue-batch-user-role was incorrectly bound to the system:authenticated group, effectively allowing any authenticated entity, including low-privileged user workbench or notebook-associated service accounts, to create OpenShift Jobs in arbitrary namespaces. An attacker can abuse this capability from a standard Jupyter notebook or similar authenticated OpenShift AI context to schedule a malicious job in a privileged namespace, run it under a higher-privilege ServiceAccount, and capture elevated credentials. This breaks intended privilege boundaries between ordinary OpenShift AI users and cluster-administrative contexts and can lead to full cluster takeover, including potential pivoting to highly privileged node-level access.
Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.
What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
If you can’t patch tonight, do this now.
Patch, then assume compromise.
1 valid exploit after Mallory filtered fakes, detection scripts, and README-only repos.
This repository is a compact Kubernetes/OpenShift exploit demonstration and response workflow for CVE-2025-10725, centered on an RBAC misconfiguration attributed to OpenShift AI Kueue integration. The main exploit is in attack.yml: it defines a batch/v1 Job named 'innocent-data-export' in the protected namespace 'privileged-infra' and explicitly runs it as the privileged ServiceAccount 'infra-operator-sa'. Inside the container, a shell payload reads the mounted token from /var/run/secrets/kubernetes.io/serviceaccount/token and uses curl against the in-cluster API endpoint https://kubernetes.default.svc/api/v1/secrets?limit=5 to enumerate secret names, demonstrating privilege escalation and secret access. Repository structure: setup.yml provisions the demo environment, including namespaces, service accounts, and the vulnerable ClusterRole/ClusterRoleBinding that grants system:authenticated permission to create/manage Jobs cluster-wide. attack.yml is the exploit artifact. rulebooks/rulebook.yml is an event-driven automation rulebook that watches for Job creation in the protected namespace and triggers remediation. remediate.yml deletes the detected Job and verifies removal. teardown.yml removes the demo RBAC artifacts. inventory is a minimal Ansible localhost inventory. This is not just a detector; it contains a working exploit path plus defensive automation. It appears to be built around Ansible/Event-Driven Ansible style automation rather than a mainstream exploit framework, so the maturity is operational: the payload is functional but simple and hardcoded. The attack vector is primarily cloud/container/network via Kubernetes API abuse and RBAC privilege escalation.
38 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A previously noted privilege escalation vulnerability in Red Hat OpenShift AI Service, mentioned only as background vendor security history.
A privilege escalation vulnerability in OpenShift AI Service, mentioned only as historical background.
A critical vulnerability in Red Hat OpenShift AI, details not specified in the content.
A high-severity privilege escalation / cluster takeover vulnerability in Red Hat OpenShift AI caused by an overly broad ClusterRoleBinding (kueue-batch-user-role bound to system:authenticated), allowing low-privileged authenticated users/service accounts to create jobs in any namespace and pivot to cluster-admin/root on master nodes.
Query your assets running an affected version, and investigate the blast radius.
Every observed campaign linking this CVE to a named adversary.
Malware families riding this exploit, with evidence and IOCs.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Cross-references every affected SKU, including bundled OEM variants.
Community discussion across Reddit, Mastodon, and other social sources.