Known vulnerabilities in Red Hat OpenShift AI (RHOAI)

Is your version affected?

CVE list

CVE	Summary	Score	Published
CVE-2026-33236	NLTK (Natural Language Toolkit) is a suite of open source Python modules, data sets, and tutorials supporting research…	8.1 High	Mar 20, 2026
CVE-2026-33231	NLTK (Natural Language Toolkit) is a suite of open source Python modules, data sets, and tutorials supporting research…	7.5 High	Mar 20, 2026
CVE-2026-33186	gRPC-Go is the Go language implementation of gRPC	9.1 Critical	Mar 20, 2026
CVE-2026-23536	A security issue was discovered in the Feast Feature Server's `/read-document` endpoint that allows an unauthenticated…	7.5 High	Mar 20, 2026
CVE-2026-32829	lz4_flex is a pure Rust implementation of LZ4 compression/decompression	8.2 High	Mar 20, 2026
CVE-2026-4426	Libarchive: libarchive: denial of service via malformed iso file processing	6.5 Medium	Mar 19, 2026
CVE-2025-15031	A vulnerability in MLflow's pyfunc extraction process allows for arbitrary file writes due to improper handling of tar…	8.1 High	Mar 18, 2026
CVE-2026-30922	pyasn1 is a generic ASN.1 library for Python	7.5 High	Mar 18, 2026
CVE-2026-28500	Open Neural Network Exchange (ONNX) is an open standard for machine learning interoperability	8.6 High	Mar 18, 2026
CVE-2026-27459	pyOpenSSL is a Python wrapper around the OpenSSL library	7.2 High	Mar 17, 2026
CVE-2026-32981	A path traversal vulnerability was identified in Ray Dashboard (default port 8265) in Ray versions prior to 2.8.1	8.7 High	Mar 17, 2026
CVE-2025-69196	FastMCP is the standard framework for building MCP applications	7.4 High	Mar 16, 2026
CVE-2026-28498	Authlib is a Python library which builds OAuth and OpenID Connect servers	8.2 High	Mar 16, 2026
CVE-2026-27962	Authlib is a Python library which builds OAuth and OpenID Connect servers	9.1 Critical	Mar 16, 2026
CVE-2025-14287	A command injection vulnerability exists in mlflow/mlflow versions before v3.7.0, specifically in the…	7.5 High	Mar 15, 2026
CVE-2026-32640	SimpleEval is a library for adding evaluatable expressions into python projects	8.7 High	Mar 13, 2026
CVE-2026-4105	Systemd: systemd: privilege escalation via improper access control in registermachine d-bus method	6.7 Medium	Mar 13, 2026
CVE-2026-32597	PyJWT is a JSON Web Token implementation in Python	7.5 High	Mar 12, 2026
CVE-2026-2229	ImpactThe undici WebSocket client is vulnerable to a denial-of-service attack due to improper validation of…	7.5 High	Mar 12, 2026
CVE-2026-1528	ImpactA server can reply with a WebSocket frame using the 64-bit length form and an extremely large length	7.5 High	Mar 12, 2026
CVE-2026-1526	The undici WebSocket client is vulnerable to a denial-of-service attack via unbounded memory consumption during…	7.5 High	Mar 12, 2026
CVE-2026-32274	Black is the uncompromising Python code formatter	8.7 High	Mar 12, 2026
CVE-2026-32141	flatted is a circular JSON parser	7.5 High	Mar 12, 2026
CVE-2026-28356	multipart is a fast multipart/form-data parser for python	7.5 High	Mar 12, 2026
CVE-2026-31892	Argo Workflows is an open source container-native workflow engine for orchestrating parallel jobs on Kubernetes	8.9 High	Mar 11, 2026

Other Red Hat products