中
6.5
A flaw was found in the `lm-evaluation-harness` component of Red Hat OpenShift AI. An...
CVE-2026-17557
SecPulse初出
影響パッケージ
| 種類 | パッケージ | 影響を受ける版 | 直った版 |
|---|---|---|---|
| Red Hat | Red Hat OpenShift AI (RHOAI) | — | — |
原文の説明 取得元が公開している説明をそのまま載せています (多くは英語)。
A flaw was found in the lm-evaluation-harness component of Red Hat OpenShift AI. An authenticated user, able to submit an evaluation job, could exploit this by providing a malicious model URL in the JobSpec. This vulnerability allows for the disclosure of the tenant's model authentication secret to an attacker-controlled external listener. Additionally, it enables Server-Side Request Forgery (SSRF) attacks against internal network endpoints reachable from the evaluation job pod.
出典: NIST National Vulnerability Database NVD GitHub Advisory
参照URL
- web secalert@redhat.com
- web secalert@redhat.com
- web nvd.nist.gov
- web github.com