VDB
CVE-2025-12805
CVE-2025-12805
PUBLISHED
CVSS 8.100000381469727 HIGH
A flaw was found in Red Hat OpenShift AI (RHOAI) llama-stack-operator. This vulnerability allows unauthorized access to Llama Stack services deployed in other namespaces via direct network requests, because no NetworkPolicy restricts access to the llama-stack service endpoint. As a result, a user in one namespace can access another user’s Llama Stack instance and potentially view or manipulate sensitive data.
EPSS 0.02% · 4.0th percentile
Risk Scores
CVSS 3.1
8.100000381469727
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
EPSS Score
0.02%
4.0th percentile
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| redhat | openshift_ai | 2.25 |
| Red Hat | Red Hat OpenShift AI 2.25 | sha256:c0d95dfbae20e87113ffb81026d379bb63ad300447df98b27d1bf9a83b084744, sha256:1d258fe98c2477e4256a9b936f412f2501fb7ca9e3b810347f9712e0d5ce5c92, sha256:c0d95dfbae20e87113ffb81026d379bb63ad300447df98b27d1bf9a83b084744 |
| Red Hat | Red Hat OpenShift AI (RHOAI) | |
| Red Hat | Red Hat OpenShift AI (RHOAI) |
Timeline
- Mar 26, 2026 CVE Published
- Mar 26, 2026 PoC Published
- Mar 26, 2026 PoC Published
- Mar 26, 2026 PoC Published
- Mar 26, 2026 PoC Published
- Mar 27, 2026 CVE Updated
- Mar 27, 2026 Distribution Patch
- Mar 27, 2026 Distribution Patch
- Mar 27, 2026 Security Advisory
- Mar 27, 2026 Security Advisory
- Mar 27, 2026 PoC Published
- Mar 29, 2026 Security Advisory
References
- RHSA-2026:2106 vendor-advisory
- RHSA-2026:2695 vendor-advisory
- https://access.redhat.com/security/cve/CVE-2025-12805 vdb
- RHBZ#2413101 issue
- https://nvd.nist.gov/vuln/detail/CVE-2025-12805 advisory