CVE-2025-12805
Redhat Openshift Ai 2.25
Raw vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:NSummary
CVE-2025-12805 is a high-severity Improper Isolation or Compartmentalization (CWE-653) vulnerability in Redhat Openshift Ai. Its CVSS base score is 8.1 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Escape to Host (T1611); ranked at the 31th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
This vulnerability is AI-related — categorised as NLP and Transformers; in the Supply Chain and Deployment risk domain.
The strongest mitigations our analysis identified map to SC-2 (Separation of System and User Functionality) and SC-3 (Security Function Isolation) — see the control section below for these in your framework.
Deeper analysis AI-assisted summary
Synthesised by an AI model from the NVD description and linked references — a reading aid, not an authoritative source.
CVE-2025-12805 is a vulnerability in the Red Hat OpenShift AI (RHOAI) llama-stack-operator that enables unauthorized access to Llama Stack services deployed in other namespaces. The issue stems from the absence of a NetworkPolicy restricting access to the llama-stack service endpoint, allowing direct network requests to bypass namespace isolation. It is associated with CWE-653 and carries a CVSS v3.1 base score of 8.1 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N).
A low-privileged user (PR:L) within one namespace can exploit this vulnerability remotely over the network (AV:N) with low attack complexity (AC:L) and no user interaction required. Successful exploitation grants access to another user's Llama Stack instance, enabling the viewing or manipulation of sensitive data (high confidentiality and integrity impact, no availability impact).
Red Hat has addressed this vulnerability through security advisories RHSA-2026:2106 and RHSA-2026:2695, with additional details available on their CVE page (https://access.redhat.com/security/cve/CVE-2025-12805) and Bugzilla entry 2413101 (https://bugzilla.redhat.com/show_bug.cgi?id=2413101). Practitioners should consult these resources for patch deployment and mitigation instructions.
This vulnerability is relevant to AI/ML workloads in multi-tenant OpenShift environments, as Llama Stack services handle potentially sensitive model inference or data processing. No public information on real-world exploitation is available as of the CVE publication date of 2026-03-26.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-209086
Vulnerability Data
A flaw was found in Red Hat OpenShift AI (RHOAI) llama-stack-operator. This vulnerability allows unauthorized access to Llama Stack services deployed in other namespaces via direct network requests, because no NetworkPolicy restricts access to the llama-stack service endpoint. As a…
more
result, a user in one namespace can access another user’s Llama Stack instance and potentially view or manipulate sensitive data.
- CWE(s)
AI Security AnalysisAI
- AI Category
- NLP and Transformers
- Risk Domain
- Supply Chain and Deployment
- OWASP Top 10 for LLMs 2025
- None mapped
- Classification Reason
- Matched keywords: ai
Related Threats
MITRE ATT&CK Enterprise Techniques
CVEs Like This One
Affected Assets
Mitigating Controls
Control response
—
—
- 8 hardening rules · 7 OS baselines
—
Mitigating Controls (NIST 800-53 r5) AI
Security function isolation is the canonical mechanism for protecting higher-privilege compartments.
Process isolation maintains separate execution domains so one process cannot affect another’s privilege level.
Explicit separation of user and management functionality implements the required compartmentalization.
System partitioning creates distinct domains that enforce isolation between differently privileged components.
Access enforcement directly requires approved authorizations to be applied to compartmentalized resources.
Information flow enforcement structurally prevents unauthorized mixing of data or functions across privilege boundaries.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
Segregation of duties directly enforces separation of privilege levels and functions.
Network segregation is a classic technical control for isolating different privilege domains.
Secure system architecture principles explicitly call for isolation and least-privilege boundaries.
Separation of development, test and production environments is a direct application of compartmentalization.
Access control policies establish the boundaries that isolation must enforce.
Managing access rights is the operational mechanism for compartmentalizing privileges.
Hardening callouts derived
Configuration rules from DISA STIG baselines that bear on weaknesses of the type cited by this CVE. Each rule is shown with the relationship its mapping actually records, against the CWE it was authored against. Derived via CVE→CWE over `controls_xwalks` (authoritative rows only; rows rated `none` are excluded).
Oracle Linux 9 (1 rule)
- V-271452 OL 9 must use a Linux Security Module configured to enforce limits on system services. prevents CWE-653
RHEL 9 (2 rules)
- V-258078 RHEL 9 must use a Linux Security Module configured to enforce limits on system services. prevents CWE-653
- V-272496 RHEL 9 must elevate the SELinux context when an administrator calls the sudo command. prevents CWE-653
Windows 10 (1 rule)
- V-220712 Only accounts responsible for the administration of a system must have Administrator rights on the system. prevents CWE-653
Windows 11 (1 rule)
- V-253269 Only accounts responsible for the administration of a system must have Administrator rights on the system. prevents CWE-653
Windows Server 2016 (1 rule)
- V-225007 Only administrators responsible for the member server or standalone or nondomain-joined system must have Administrator rights on the system. prevents CWE-653