CVE-2025-12805: redhat openshift_ai

Vulnerability summary

CVE-2025-12805 is a high (CVSS 8.1) vulnerability in redhat openshift_ai. EPSS estimates a 0.38% chance of exploitation in the next 30 days, higher than 30.8% of scored vulnerabilities. 1 public exploit is recorded.

Timeline

1. 26-03-2026
   PublishedVulnerability first disclosed.
2. 31-03-2026
   Last modifiedVulnerability information updated.

Description

A flaw was found in Red Hat OpenShift AI (RHOAI) llama-stack-operator. This vulnerability allows unauthorized access to Llama Stack services deployed in other namespaces via direct network requests, because no NetworkPolicy restricts access to the llama-stack service endpoint. As a result, a user in one namespace can access another user’s Llama Stack instance and potentially view or manipulate sensitive data.

• CWE-653Improper Isolation or CompartmentalizationThe product does not properly compartmentalize or isolate functionality, processes, or resources that require different privilege levels, rights, or permissions.