CVE Tools
Track your stack

Red Hat Openshift AI (Rhoai)

117 CVEs tracked. None of them is in CISA KEV.

This hub aggregates every CVE we track for Red Hat Openshift AI (Rhoai), a product in the cloud saas space. Use it to gauge the current risk picture and drill into individual advisories.

Red Hat Openshift AI (Rhoai) CVEs per month

Dec 2024 to Nov 2026. Point at a month, or focus the strip and use the arrow keys.
Red Hat Openshift AI (Rhoai) CVEs per month
MonthCVEs
2024-120
2025-010
2025-021
2025-030
2025-041
2025-052
2025-068
2025-070
2025-081
2025-090
2025-101
2025-110
2025-120
2026-019
2026-022
2026-034
2026-045
2026-053
2026-0618
2026-078
2026-0816
2026-0916
2026-1017
2026-114

Severity

How the 117 CVEs score on CVSS. Severity is not exploitation: KEV is counted above.

  • Critical54%
  • High3631%
  • Medium5750%
  • Low1715%

Latest CVEs

The 15 most recently published vulnerabilities affecting Red Hat Openshift AI (Rhoai).

  1. CVE-2026-83495Trainer: trainer: trainjob env passthrough enables valuefrom.secretkeyref injection for namespace secret exfiltration—
  2. CVE-2026-83494Training-operator: pytorchjob validateupdate casts oldjob from newobj, bypassing managedby immutability (asvs v5.1.3; upstream bug)—
  3. CVE-2026-83493Distributed-workloads: github actions pinned by mutable tag/branch, including third-party snyk/actions/setup@master9.1
  4. CVE-2026-107912Io.quarkus/quarkus-vertx-http: quarkus-vertx-http: authorization bypass in management interface via path concatenation flaw7.7
  5. CVE-2026-120194Json-glib: json-glib: infinite loop in json_path_query() with negative jsonpath slice step7.5
  6. CVE-2026-115456Gcc: out-of-bounds read in std::from_chars3.7
  7. CVE-2026-114691Gcc: integer wrap in `std5.9
  8. CVE-2026-114690Gcc: confirmed out-of-bounds read/write in libstdc++ parallel `std6.2
  9. CVE-2026-117574Ai-gateway-payload-processing: ai-gateway-payload-processing: tenant/credential selection from client-controlled url path with no in-process authorization9.1
  10. CVE-2026-13451Kserve: kserve: server-side request forgery via malicious storageuri7.7
  11. CVE-2026-114406Ca-certificates: distrust emudhra intermediate ca certificates due to security concerns6.8
  12. CVE-2026-114236Podman: goroutine/file-descriptor leak in storage/pkg/archive.applylayer and applyuncompressedlayer on malformed layers3.3
  13. CVE-2026-17557Lm-evaluation-harness: lm-evaluation-harness: ssrf via job-spec model.url with bearer credential forwarding6.5
  14. CVE-2026-92824Libmodulemd: libmodulemd: out-of-bounds read when emitting rpm-map artifacts6.2
  15. CVE-2026-92822Libmodulemd: libmodulemd: unbounded recursion when parsing nested xmd yaml6.2

Product grouping is registry-driven, with AI assist and human review. How it works