CVE Feed

    Dashboard / CVE / CVE-2025-12805

    CVE-2025-12805

    A flaw was found in Red Hat OpenShift AI (RHOAI) llama-stack-operator. This vulnerability allows unauthorized access to Llama Stack services deployed in other namespaces via direct network requests, because no NetworkPolicy restricts access to the llama-stack service endpoint. As a result, a user in one namespace can access another user’s Llama Stack instance and potentially view or manipulate sensitive data.

    Published:Dec 31, 2025
    Last Modified:Apr 30, 2026
    EPS:Mar 26, 2026
    EPSS Score:0.00014
    CVSS Score:8.1

    Affected Products

    Vendor
    Redhat
    Product
    Openshift Ai

    Exploits

    https://bugzilla.redhat.com/show_bug.cgi?id=2413101

    Common Attack Pattern Enumeration and Classification (CAPEC)

    No CAPEC recorded yet

    Related CVEs

    CVE-2026-86332 (CVSS 6.5) — A flaw was found in odh-dashboard in Red Hat OpenShift AI. The backend-for-frontend route GET /api/nim-serving…
    CVE-2026-84185 (CVSS 5.9) — A flaw was found in the jwcrypto library, which is used for implementing Javascript Object Signing and Encrypt…
    CVE-2026-18393 (CVSS 5.4) — A flaw was found in FFmpeg. The tdsc_load_cursor() function writes beyond the bounds of a heap-allocated buffe…
    CVE-2026-80179 (CVSS 5.9) — A flaw was found in jwcrypto. A remote attacker can send a specially crafted JSON Web Encryption (JWE) token c…
    CVE-2026-15218 (CVSS 7.9) — A flaw was found in the maas-api and maas-controller ServiceAccounts within Red Hat OpenShift AI. These Servic…
    CVE-2026-18947 (CVSS 8.5) — A flaw was found in Feast. An authorization bypass vulnerability exists in the /materialize and /materialize-i…
    CVE-2026-18982 (CVSS 8.8) — A flaw was found in the RHOAI training-operator. This vulnerability allows a user with standard edit or admin …
    CVE-2026-18951 (CVSS 8.8) — A flaw was found in the Red Hat OpenShift AI (RHOAI) overlay for the training operator. The RHOAI overlay inco…
    CVE-2026-18950 (CVSS 8.8) — A flaw was found in odh-dashboard. An authenticated user of the dashboard can exploit a vulnerability related …
    CVE-2026-18949 (CVSS 8.8) — A flaw was found in odh-dashboard. This vulnerability allows an attacker, who has compromised the dashboard's …

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High