CVE-2025-10725
Description
A flaw was found in Red Hat Openshift AI Service. A low-privileged attacker with access to an authenticated account, for example as a data scientist using a standard Jupyter notebook, can escalate their privileges to a full cluster administrator. This allows for the complete compromise of the cluster's confidentiality, integrity, and availability. The attacker can steal sensitive data, disrupt all services, and take control of the underlying infrastructure, leading to a total breach of the platform and all applications hosted on it.
Statement
Red Hat Security Ratings classify this as an Important and not Critical because it requires minimal authentication for the remote attacker to jeopardize an environment. Following https://access.redhat.com/security/updates/classification
Mitigation
RHOAI versions 2.16.x
The recommended fix is to upgrade to version 2.16.3.
However, if Kueue features are not required, the Kueue component management state can be set to "Removed" in the RHOAI DataScienceCluster resource:
oc patch dsc default-dsc --type=merge -p='{"spec":{"components":{"kueue":{"managementState":"Removed"}}}}' -n redhat-ods-operator
RHOAI versions 2.19+
The recommended fix is to apply the available erratum.
Alternatively, follow these steps:
1. Prevent the RHOAI operator from managing the kueue-batch-user-rolebinding by applying the necessary annotation:
oc patch clusterrolebinding kueue-batch-user-rolebinding -p '{"metadata":{"annotations": \{"opendatahub.io/managed":"false"}}}'
2. Disable the ClusterRoleBinding by updating its subject to a different, non-existent, group:
oc patch clusterrolebinding kueue-batch-user-rolebinding \
-p '{
"subjects": [
{
"kind": "Group",
"name": "REPLACEME",
"apiGroup": "rbac.authorization.k8s.io"
}
]
}'
It is important that the group used for the subject does not exist on the cluster to prevent the risk of unintentionally assigning these permissions to other non-privileged users.
3. Once updates providing fixes have been applied, it's recommended to remove the clusterrolebinding created in step 2 of the mitigation.
oc delete clusterrolebinding kueue-batch-user-rolebinding
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 9.9 | N/A | N/A |
| Attack Vector | Network | N/A | N/A |
| Attack Complexity | Low | N/A | N/A |
| Privileges Required | Low | N/A | N/A |
| User Interaction | None | N/A | N/A |
| Scope | Changed | N/A | N/A |
| Confidentiality | High | N/A | N/A |
| Integrity Impact | High | N/A | N/A |
| Availability Impact | High | N/A | N/A |
Vector
Red Hat: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Understanding the Weakness (CWE)
Access Control
Technical Impact: Gain Privileges or Assume Identity
A user can access restricted functionality and/or sensitive information that may include administrative functionality and user accounts.
Acknowledgements
This issue was discovered by Jon Weiser (Red Hat), Oleg Sushchenko (Red Hat), and Raul Bringas (Red Hat).
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
