Known vulnerabilities in Red Hat OpenShift AI (RHOAI)

Is your version affected?

CVE list

CVE	Summary	Score	Published
CVE-2026-34444	Lupa integrates the runtimes of Lua or LuaJIT2 into CPython	7.9 High	Apr 6, 2026
CVE-2026-0545	In mlflow/mlflow, the FastAPI job endpoints under `/ajax-api/3.0/jobs/*` are not protected by authentication or…	9.1 Critical	Apr 3, 2026
CVE-2026-34742	The Go MCP SDK used Go's standard encoding/json	7.6 High	Apr 2, 2026
CVE-2026-34601	xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core) `DOMParser` and `XMLSerializer` module	7.5 High	Apr 2, 2026
CVE-2026-32871	FastMCP is a Pythonic way to build MCP servers and clients	10.0 Critical	Apr 2, 2026
CVE-2026-27489	Open Neural Network Exchange (ONNX) is an open standard for machine learning interoperability	8.7 High	Apr 1, 2026
CVE-2026-4800	The fix for CVE-2021-23337 added validation for the variable option in _.template but did not apply the same…	8.1 High	Mar 31, 2026
CVE-2026-34070	LangChain is a framework for building agents and LLM-powered applications	7.5 High	Mar 31, 2026
CVE-2025-15379	A command injection vulnerability exists in MLflow's model serving container initialization code, specifically in the…	10.0 Critical	Mar 30, 2026
CVE-2025-15036	A path traversal vulnerability exists in the `extract_archive_to_dir` function within the…	9.6 Critical	Mar 30, 2026
CVE-2026-33941	Handlebars provides the power necessary to let users build semantic templates	8.3 High	Mar 27, 2026
CVE-2026-33940	Handlebars provides the power necessary to let users build semantic templates	8.1 High	Mar 27, 2026
CVE-2026-33939	Handlebars provides the power necessary to let users build semantic templates	7.5 High	Mar 27, 2026
CVE-2026-33938	Handlebars provides the power necessary to let users build semantic templates	8.1 High	Mar 27, 2026
CVE-2026-33937	Handlebars provides the power necessary to let users build semantic templates	9.8 Critical	Mar 27, 2026
CVE-2026-33871	Netty is an asynchronous, event-driven network application framework	8.7 High	Mar 27, 2026
CVE-2026-33870	Netty is an asynchronous, event-driven network application framework	7.5 High	Mar 27, 2026
CVE-2025-15381	Unauthorized Access to Tracing and Assessment Endpoints in mlflow/mlflow	8.1 High	Mar 27, 2026
CVE-2026-27893	vLLM is an inference and serving engine for large language models (LLMs)	8.8 High	Mar 26, 2026
CVE-2025-12805	A flaw was found in Red Hat OpenShift AI (RHOAI) llama-stack-operator	8.1 High	Mar 26, 2026
CVE-2026-32286	The DataRow.Decode function fails to properly validate field lengths	7.5 High	Mar 26, 2026
CVE-2026-4926	Impact: A bad regular expression is generated any time you have multiple sequential optional groups (curly brace…	7.5 High	Mar 26, 2026
CVE-2025-67030	Directory Traversal vulnerability in the extractFile method of org.codehaus.plexus.util.Expand in plexus-utils before…	8.8 High	Mar 25, 2026
CVE-2026-33211	Tekton Pipelines project provides k8s-style resources for declaring CI/CD-style pipelines	9.6 Critical	Mar 23, 2026
CVE-2026-33228	flatted is a circular JSON parser	8.9 High	Mar 20, 2026

Other Red Hat products