CVE-2025-10725
BaseFortify
Publication date: 2025-09-30
Last updated on: 2025-11-06
Assigner: Red Hat, Inc.
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| redhat | openshift_ai | 2.16.3 |
| redhat | openshift_ai | 2.19.3 |
| redhat | openshift_ai | 2.22.2 |
| redhat | openshift_ai | 2.24.0 |
| redhat | openshift_ai | 2.21.1 |
| redhat | openshift_ai | * |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-266 | A product incorrectly assigns a privilege to a particular actor, creating an unintended sphere of control for that actor. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability in Red Hat Openshift AI Service allows a low-privileged attacker with an authenticated account, such as a data scientist using a standard Jupyter notebook, to escalate their privileges to become a full cluster administrator. This means the attacker can gain complete control over the cluster.
How can this vulnerability impact me? :
The vulnerability can lead to a total compromise of the cluster's confidentiality, integrity, and availability. An attacker can steal sensitive data, disrupt all services, and take control of the underlying infrastructure, affecting all applications hosted on the platform.