CVE-2026-17557
CVE-2026-17557 · Lm-evaluation-harness: lm-evaluation-harness: ssrf via job-spec model.url with bearer credential forwarding
Cette page présente des faits issus de sources publiques. Consultez l’avis original avant toute mise à jour.
A flaw was found in the `lm-evaluation-harness` component of Red Hat OpenShift AI. An authenticated user, able to submit an evaluation job, could exploit this by providing a malicious model URL in the `JobSpec`. This vulnerability allows for the disclosure of the tenant's model authentication secret to an attacker-controlled external listener. Additionally, it enables Server-Side Request Forgery (SSRF) attacks against internal network endpoints reachable from the evaluation job pod.
CVSS 6.5 · Moyenne · EPSS 0,3%
- Publication
- Mise à jour
Produits et versions concernés
red hat openshift ai (rhoai)
Aucun correctif publié