Loading vulnerability…
Cross-namespace unauthorized access in Red Hat OpenShift AI llama-stack-operator
CVE-2025-12805 is a vulnerability in Red Hat OpenShift AI (RHOAI) llama-stack-operator caused by the absence of a NetworkPolicy restricting access to the llama-stack service endpoint. Because the deployed Llama Stack service is not isolated at the network layer, a user with access from one namespace can send direct network requests to Llama Stack services running in other namespaces. This breaks expected namespace-level tenant isolation and can expose another user’s Llama Stack instance to unauthorized access. The issue may allow an attacker to view or manipulate sensitive data associated with another tenant’s Llama Stack deployment.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation allows cross-namespace unauthorized access to Llama Stack services. An attacker operating from one namespace can reach another namespace’s llama-stack service endpoint and potentially read sensitive data or modify data handled by that instance. Based on the provided CVSS vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N), the primary impacts are high confidentiality loss and high integrity loss, with no stated availability impact.
If you can’t patch tonight, do this now.
Until patched, restrict network reachability to llama-stack service endpoints using Kubernetes/OpenShift NetworkPolicy rules that explicitly limit ingress to only the intended pods, namespaces, or service accounts. Review namespace-to-namespace connectivity for RHOAI deployments, minimize tenant co-residency where possible, and monitor for unexpected cross-namespace access to Llama Stack services.
Patch, then assume compromise.
Apply the vendor-provided fixes from Red Hat for CVE-2025-12805, including the relevant errata referenced for this issue (RHSA-2026:2106 and RHSA-2026:2695). The remediation should ensure that appropriate NetworkPolicy controls are created or enforced for llama-stack service endpoints so that only authorized pods/namespaces can connect.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
9 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.