CVE Vulnerability Catalog

A vulnerability was found in libvirt where the virFileChownFiles() function follows symbolic links. A local attacker running as the swtpm user can plant a symlink in the swtpm state directory, causing the root-level libvirt daemon to change ownership of an arbitrary file to the swtpm user.

A vulnerability in RHOAI training-operator allows a user with standard edit or admin roles in any Kubernetes namespace to escalate privileges. By creating training jobs, an attacker can impersonate service accounts, access the host filesystem, and potentially execute arbitrary code remotely.

A vulnerability in the RHOAI overlay for the training operator incorrectly aggregates trainjobs management permissions into the native Kubernetes 'edit ClusterRole'. This allows any user with edit permissions in a namespace to create, modify, and delete TrainJobs, which combined with another vulnerability can lead to privilege escalation and remote code execution.

A vulnerability was found in odh-dashboard related to how RoleBindings are created. The system does not properly validate the 'roleRef' field, allowing a user to specify an arbitrary role, including highly privileged ones like 'cluster-admin'. This can lead to privilege escalation and persistent control over the system.

A vulnerability in odh-dashboard allows an attacker who has compromised the dashboard's Service Account (SA) token to exploit overly broad permissions granted to the SA. This enables privilege escalation to cluster-administrator level, access to sensitive data like credentials and keys, and disruption of multi-tenant isolation.

A vulnerability in Feast allows authorization bypass in the /materialize and /materialize-incremental endpoints. By sending a specially crafted request that omits the feature_views field, an attacker can bypass permission checks, allowing an unauthenticated remote attacker or any authenticated user to trigger a full re-materialization of all feature views. This results in a Denial of Service (DoS) due to data corruption and significant resource consumption.

A vulnerability in Feast and feast-operator is due to the default 'no_auth' configuration, which installs no security manager. This allows unauthenticated and unauthorized access to feature-server, registry-server, and offline-server endpoints. A remote attacker can exploit the missing authentication to achieve remote code execution (RCE) by storing a malicious UDF, trigger DoS by forcing re-materialization, and gain unauthorized access to cross-tenant data.

A vulnerability in Data Science Pipelines (DSP) allows an attacker with namespace editor privileges to bypass security hardening by submitting a malicious Argo Workflow through the V1 API path. This allows the API server to create pods with elevated privileges, acting as a 'confused deputy'. Successful exploitation grants the attacker node-root access, enabling arbitrary code execution and full control over the node.

A vulnerability in Data Science Pipelines involves improper authorization in the setDefaultServiceAccount function. A restricted user can specify a more privileged ServiceAccount (SA) during a CreateRun request, bypassing authorization checks. This allows the tenant to run containers with elevated privileges, potentially leading to disclosure of sensitive information (secrets) and execution of commands within other users' pods.

A flaw was found in ml-metadata where the statically-linked gRPC stack is outdated, making it vulnerable to known HTTP/2 denial of service (DoS) issues. An in-cluster attacker with network access to the MLMD pod could exploit this by sending specially crafted HTTP/2 requests, potentially crashing the pod and disrupting pipeline runs.

A flaw was found in the Data Science Pipelines Operator (DSPO) where the spec.database.customExtraParams field allows injection of dangerous parameters into the MySQL DSN string. An attacker with namespace editor privileges can enable LOCAL INFILE and exfiltrate sensitive files like the service account token, leading to privilege escalation to cluster-admin.

A flaw was found in the Data Science Pipelines Operator where credentials like MariaDB passwords and MinIO keys are generated using a cryptographically weak PRNG, making them predictable. An unauthenticated attacker with access to the MinIO Route or MariaDB Service can derive these credentials and gain unauthorized access to all pipeline artifacts and metadata.

A flaw was found in the Data Science Pipelines Operator (DSPO) where its ClusterRole grants excessive privileges, including the ability to execute commands in pods and manage cluster-wide roles. If the DSPO pod is compromised, an attacker could leverage these privileges to gain full administrative control over the entire Kubernetes cluster.

A flaw was found in the TrustyAI Service (TAS) deployment that allows any pod on the cluster network to bypass authentication and directly access the TAS backend API. An attacker can read, tamper with, or delete monitoring data and configurations, and inject arbitrary data, potentially disrupting tenant operations.

A flaw was found in the trustyai-service-operator's LMEvalJob controller that allows an authenticated user within the cluster to configure a sidecar container to bypass existing security policies. This enables the execution of untrusted remote code, leading to arbitrary code execution within the cluster.

A flaw was found in the Red Hat OpenShift AI (RHOAI) MaaS Gateway where improper configuration allows a standard user with low privileges to intercept, read, log, and alter all MaaS model traffic. This includes sensitive information such as access keys, input prompts, and outputs, leading to significant information disclosure and data tampering.

A flaw was found in the UpdateHub firmware-update agent's probe handler that parses JSON metadata from the update server into a fixed two-level nested-array struct. It validates only the outer array length and then dereferences objects[1].objects[0].objects.sha256sum via strlen() without checking that the inner object array is non-empty. A malicious or compromised update server (or a man-in-the-middle when DTLS is disabled) can return a response with an empty inner array, leading to a NULL pointer dereference and a CPU fault, causing a denial of service. The flaw is remotely triggerable and limited to availability.

In Dokploy prior to 0.29.13, sanitizeCommand in compose.ts only trims whitespace and strips surrounding quotes from compose.command before exportEnvCommand and docker command interpolation, allowing an authenticated user who can update a Compose service to inject shell metacharacters and execute arbitrary commands on the Dokploy host. This issue is fixed in version 0.29.13.

In Dokploy prior to 0.29.13, the WebSocket handlers validate organization membership but do not enforce checkServiceAccess, accessedServerIds, or accessedServices, allowing an authenticated organization member to obtain root terminal access and read logs or statistics for restricted servers and services. This issue is fixed in version 0.29.13.

Dokploy prior to 0.29.13 contains a command injection vulnerability in settings.readTraefikFile. A user with traefikFiles.read permission can execute arbitrary commands on a managed server via shell metacharacters in the configPath.