CVE-2026-17557
CVE-2026-17557 · Lm-evaluation-harness: lm-evaluation-harness: ssrf via job-spec model.url with bearer credential forwarding
This page contains facts from public vulnerability sources. Check the original advisory before updating.
A flaw was found in the `lm-evaluation-harness` component of Red Hat OpenShift AI. An authenticated user, able to submit an evaluation job, could exploit this by providing a malicious model URL in the `JobSpec`. This vulnerability allows for the disclosure of the tenant's model authentication secret to an attacker-controlled external listener. Additionally, it enables Server-Side Request Forgery (SSRF) attacks against internal network endpoints reachable from the evaluation job pod.
CVSS 6.5 · Medium · EPSS 0.3%
- Published
- Updated
Affected products and versions
red hat openshift ai (rhoai)
No fix published