CVE-2026-13717
HighCVSS 8.8Exploitation Probability (EPSS)
Low risk28th percentile - higher than 28% of all known CVEs
Summary
A flaw was found in the Red Hat OpenShift AI (RHOAI) MaaS Gateway where improper configuration allows a standard user with low privileges to intercept, read, log, and alter all MaaS model traffic. This includes sensitive information such as access keys, input prompts, and outputs, leading to significant information disclosure and data tampering.
Risk Assessment
The risk includes leakage of sensitive data and potential tampering with model traffic, compromising data confidentiality and integrity.
Recommendation
Improve the MaaS Gateway configuration to restrict access to model traffic and implement access control mechanisms.
Original NVD description (English source)
A flaw was found in the Red Hat OpenShift AI (RHOAI) MaaS Gateway. Improper configuration of the Gateway in a model-serving context allows a standard user with low privileges to intercept, read, log, and alter all MaaS model traffic. This includes sensitive information such as access keys, input prompts, and outputs, leading to significant information disclosure and data tampering.