CVE-2025-10725

criticalPriorität · verfolgen · 10EPSS 0.007 · 54. PerzentilExploit · PoCDEEURUUS
grimoire priorityP1 · Urgent
Exploitable?
Public exploit
1 exploit · PoC
Likely / severe?
0.72% (54th) EPSS
CVSS 9.9 · critical
Is it mine?
38 products
Prüfe deine Angriffsfläche
Who says so?
5 sources
cnnvd · enisa_euvd · fstec_bdu · cert_bund

EPSS · bewertet 2026-10-27

A flaw was found in Red Hat Openshift AI Service. A low-privileged attacker with access to an authenticated account, for example as a data scientist using a standard Jupyter notebook, can escalate their privileges to a full cluster administrator. This allows for the complete compromise of the cluster's confidentiality, integrity, and availability. The attacker can steal sensitive data, disrupt all services, and take control of the underlying infrastructure, leading to a total breach of the platform and all applications hosted on it.

01

Behebungen

Hersteller-Fix, Mitigation oder Workaround, wie von den Quellen veröffentlicht.

Ein Hersteller-Fix ist verfügbar.

  • Behobenregistry.redhat.io/rhoai/odh-rhel9-operator@sha256:66e2c3916ae1cdb08edab90f0868965b26991ce43fb120db7f2d05311d90c9c8_ppc64le as a component of Red Hat OpenShift AI 2.21redhat_csaf

    For Red Hat OpenShift AI 2.21.0 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this errata update: https://docs.redhat.com/en/documentation/red_hat_openshift_ai/

    https://access.redhat.com/errata/RHBA-2025:16983
  • Behobenregistry.redhat.io/rhoai/odh-rhel9-operator@sha256:799b0f8dc02e0e081582f5f6594f0a224aee1472c260f31058c78f54d005d7c6_s390x as a component of Red Hat OpenShift AI 2.21redhat_csaf

    For Red Hat OpenShift AI 2.21.0 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this errata update: https://docs.redhat.com/en/documentation/red_hat_openshift_ai/

    https://access.redhat.com/errata/RHBA-2025:16983
  • Behobenregistry.redhat.io/rhoai/odh-rhel9-operator@sha256:9f7620cc36c23dbf8528ecc04742861a65e867b338c582b84055559ab553f857_amd64 as a component of Red Hat OpenShift AI 2.21redhat_csaf

    For Red Hat OpenShift AI 2.21.0 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this errata update: https://docs.redhat.com/en/documentation/red_hat_openshift_ai/

    https://access.redhat.com/errata/RHBA-2025:16983
  • Behobenregistry.redhat.io/rhoai/odh-rhel9-operator@sha256:db339d2d4f86af4efa695ef193d19e26b25fec80017fa2780833a4cd944e383b_arm64 as a component of Red Hat OpenShift AI 2.21redhat_csaf

    For Red Hat OpenShift AI 2.21.0 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this errata update: https://docs.redhat.com/en/documentation/red_hat_openshift_ai/

    https://access.redhat.com/errata/RHBA-2025:16983
  • Behobenregistry.redhat.io/rhoai/odh-rhel8-operator@sha256:03e5cbae0925efac7fd0adfb14f4317c48a7efdbdd54c7804db92a2efb3b2bfc_amd64 as a component of Red Hat OpenShift AI 2.19redhat_csaf

    For Red Hat OpenShift AI 2.19.0 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this errata update: https://docs.redhat.com/en/documentation/red_hat_openshift_ai/

    https://access.redhat.com/errata/RHBA-2025:16984
  • Behobenregistry.redhat.io/rhoai/odh-rhel8-operator@sha256:43a8904396e55074ffb1afcfcd8fe6db0edcbc918a8ff8301b6b0920aea7eabf_ppc64le as a component of Red Hat OpenShift AI 2.19redhat_csaf

    For Red Hat OpenShift AI 2.19.0 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this errata update: https://docs.redhat.com/en/documentation/red_hat_openshift_ai/

    https://access.redhat.com/errata/RHBA-2025:16984
  • Behobenregistry.redhat.io/rhoai/odh-rhel8-operator@sha256:74858d557494f60d4abaa5491b0db312a77bfb83709447b11396a0cf74bec623_s390x as a component of Red Hat OpenShift AI 2.19redhat_csaf

    For Red Hat OpenShift AI 2.19.0 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this errata update: https://docs.redhat.com/en/documentation/red_hat_openshift_ai/

    https://access.redhat.com/errata/RHBA-2025:16984
  • Behobenregistry.redhat.io/rhoai/odh-rhel8-operator@sha256:f9b4d952ca1ca80ecba82dec8f638f01a70de7404231e572ac2f51d5d31d5d28_arm64 as a component of Red Hat OpenShift AI 2.19redhat_csaf

    For Red Hat OpenShift AI 2.19.0 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this errata update: https://docs.redhat.com/en/documentation/red_hat_openshift_ai/

    https://access.redhat.com/errata/RHBA-2025:16984
  • Workaroundregistry.redhat.io/rhoai/odh-dashboard-rhel9@sha256:0a4f139cdacd228206c5a5a6b34b57ea87b040a58a46534ebc5daeda7d70cb19_amd64 as a component of Red Hat OpenShift AI 2.21redhat_csaf

    Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.

  • Workaroundregistry.redhat.io/rhoai/odh-dashboard-rhel9@sha256:301a5939cc80923b789f9efaf96601b32d067472750afb22a7d001822b235ab0_ppc64le as a component of Red Hat OpenShift AI 2.21redhat_csaf

    Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.

  • Workaroundregistry.redhat.io/rhoai/odh-dashboard-rhel9@sha256:c25cf00dde02c342509a9617a3d1b55ec72236a6dacd2f38f9331ea4d8701fa5_s390x as a component of Red Hat OpenShift AI 2.21redhat_csaf

    Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.

  • Workaroundregistry.redhat.io/rhoai/odh-dashboard-rhel9@sha256:dd32ff192490d1832df545699f66b80911f55d6ee36ead72b6a745dd7d4938e3_arm64 as a component of Red Hat OpenShift AI 2.21redhat_csaf

    Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.

  • Workaroundregistry.redhat.io/rhoai/odh-modelmesh-rhel9@sha256:687c8eeed55f021ecaab1307f0e88b5b16d91f72d63b3d7168d7bbee90e8947b_amd64 as a component of Red Hat OpenShift AI 2.21redhat_csaf

    Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.

  • Workaroundregistry.redhat.io/rhoai/odh-operator-bundle@sha256:e9612ec99daa171c403b5ddf37788526e5375b83987e5de9b1ebe519198607b4_amd64 as a component of Red Hat OpenShift AI 2.21redhat_csaf

    Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.

  • Workaroundregistry.redhat.io/rhoai/odh-rhel9-operator@sha256:66e2c3916ae1cdb08edab90f0868965b26991ce43fb120db7f2d05311d90c9c8_ppc64le as a component of Red Hat OpenShift AI 2.21redhat_csaf

    Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.

  • Workaroundregistry.redhat.io/rhoai/odh-rhel9-operator@sha256:799b0f8dc02e0e081582f5f6594f0a224aee1472c260f31058c78f54d005d7c6_s390x as a component of Red Hat OpenShift AI 2.21redhat_csaf

    Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.

  • Workaroundregistry.redhat.io/rhoai/odh-rhel9-operator@sha256:9f7620cc36c23dbf8528ecc04742861a65e867b338c582b84055559ab553f857_amd64 as a component of Red Hat OpenShift AI 2.21redhat_csaf

    Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.

  • Workaroundregistry.redhat.io/rhoai/odh-rhel9-operator@sha256:db339d2d4f86af4efa695ef193d19e26b25fec80017fa2780833a4cd944e383b_arm64 as a component of Red Hat OpenShift AI 2.21redhat_csaf

    Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.

  • Workaroundregistry.redhat.io/rhoai/odh-dashboard-rhel8@sha256:a03e4403f33af3ab32dd42d8bf8762aea079bd14d66f0543f525453acb048c80_ppc64le as a component of Red Hat OpenShift AI 2.19redhat_csaf

    Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.

  • Workaroundregistry.redhat.io/rhoai/odh-dashboard-rhel8@sha256:d316259cc9d5555c2137ba177375f64ca297ce7b3dde7ec66edb8567e110a0da_amd64 as a component of Red Hat OpenShift AI 2.19redhat_csaf

    Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.

  • Workaroundregistry.redhat.io/rhoai/odh-dashboard-rhel8@sha256:e2b51a0d81397f7318c655b76f2952bd08e333ba56aa89053357b39514c23686_s390x as a component of Red Hat OpenShift AI 2.19redhat_csaf

    Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.

  • Workaroundregistry.redhat.io/rhoai/odh-modelmesh-rhel8@sha256:53ac36baa374159b9065c718a9ede821bbb61d9ebe9502b2243e0a9f7aca0d16_amd64 as a component of Red Hat OpenShift AI 2.19redhat_csaf

    Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.

  • Workaroundregistry.redhat.io/rhoai/odh-operator-bundle@sha256:a6e02e1876fd5382ba4921dd65650b2d747666feb96c839f34e99d2972dfc323_amd64 as a component of Red Hat OpenShift AI 2.19redhat_csaf

    Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.

  • Workaroundregistry.redhat.io/rhoai/odh-rhel8-operator@sha256:03e5cbae0925efac7fd0adfb14f4317c48a7efdbdd54c7804db92a2efb3b2bfc_amd64 as a component of Red Hat OpenShift AI 2.19redhat_csaf

    Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.

  • Workaroundregistry.redhat.io/rhoai/odh-rhel8-operator@sha256:43a8904396e55074ffb1afcfcd8fe6db0edcbc918a8ff8301b6b0920aea7eabf_ppc64le as a component of Red Hat OpenShift AI 2.19redhat_csaf

    Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.

  • Workaroundregistry.redhat.io/rhoai/odh-rhel8-operator@sha256:74858d557494f60d4abaa5491b0db312a77bfb83709447b11396a0cf74bec623_s390x as a component of Red Hat OpenShift AI 2.19redhat_csaf

    Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.

  • Workaroundregistry.redhat.io/rhoai/odh-rhel8-operator@sha256:f9b4d952ca1ca80ecba82dec8f638f01a70de7404231e572ac2f51d5d31d5d28_arm64 as a component of Red Hat OpenShift AI 2.19redhat_csaf

    Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.

02

cvss

Technischer Schweregrad, 0–10. Eine Zeile je Quelle.

9.9
010

Basiswert 0–10 · höher = schwerwiegender · Vektor überfahren zum Auflösen

v3.19.9criticalAV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:Hsecondary · FSTEC (BDU) RU
v3.19.9criticalCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:Hsecondary · ENISA EU
v3.19.9criticalCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:Hsecondary · secalert@redhat.com USAusnutzbarkeit 3.1 · Auswirkung 6
v3.19.4criticalCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H/E:Psecondary · CVSS-BT (t0sche)
v3.19.9criticalCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:Hsecondary · Red Hat Product Security US
03

SSVC

Eine Handlungsentscheidung — aus Ausnutzung und Auswirkung.

Exploitation: none · Automatable: no · Technical Impact: totalcoordinatorcisa_ssvcUS
04

schwächen

Die CWE-Schwächeklassen, zu denen dies gehört.

CWE-266USCWE-266USCWE-266US
05

Exploits (1)

Öffentlicher Proof-of-Concept- und Exploit-Code.

06

betroffene Produkte (38)

Betroffene Produkte und Versionsbereiche.

20 von 38 angezeigt
07

Advisories (3)

Hersteller- und Ökosystem-Meldungen dazu.

  • RHBA-2025:16983Red Hat Bug Fix Advisory: RHOAI 2.21.0 - Red Hat OpenShift AI2025-09-29csaf · redhat_csafUS

    Updated images are now available for Red Hat OpenShift AI.

  • RHBA-2025:16984Red Hat Bug Fix Advisory: RHOAI 2.19.0 - Red Hat OpenShift AI2025-09-29csaf · redhat_csafUS

    Updated images are now available for Red Hat OpenShift AI.

  • WID-SEC-W-2025-2201Red Hat OpenShift AI: Schwachstelle ermöglicht Erlangen von AdministratorrechtenDeutsch2025-10-05csaf · cert_bundDE

    Ein entfernter, authentisierter Angreifer kann eine Schwachstelle in Red Hat OpenShift AI ausnutzen, um vollständige Cluster-Administratorrechte zu erlangen.

08

auch bekannt als (4)

Weitere Namen und Kennungen dieser Entität.

09

quellen

Welche Quellen diesen Datensatz belegen und wann.

cnnvdenisa_euvdfstec_bducert_bundredhat_csafNVDCVE.orgMITRE
veröffentlicht 2025-09-30geändert 2026-06-17
10

Referenzen (25)

Externe Belege — Patches, Meldungen, Analysen.

scry

Angreifer nutzen Schwachstellen wie diese gegen im Internet exponierte Dienste aus. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.

Kostenloser Scan