CVE-2026-100308
Description
A flaw was found in GluonTS. The model loading component fails to safely handle untrusted data during deserialization, which can allow an attacker to execute arbitrary commands with the privileges of the running process. An attacker can exploit this issue by convincing a user or system to load a specially crafted serialized model directory.
Statement
A flaw was found in Amazon GluonTS, a Python time-series modeling library included in Red Hat OpenShift AI. The model loading component does not safely handle untrusted data during deserialization: when a user or an automated process loads a specially crafted serialized model directory (for example, by calling Predictor.deserialize() on a model directory that is not fully controlled), an attacker can execute arbitrary operating system commands with the privileges of the loading process. Red Hat rates this flaw as IMPORTANT (CVSS 3.1 score 7.8, AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H), consistent with the upstream CVSS 3.1 assessment; exploitation requires a victim to load a crafted model directory, and execution is confined to the security context of the loading process. Within Red Hat OpenShift AI, this issue affects components that ship the vulnerable gluonts package, and a fix is being pursued through the affected product's update process. OpenShift AI components in which the vulnerable code is not in the execute path have been determined not to be affected.
Mitigation
Do not deserialize untrusted model artifacts: only load serialized GluonTS model directories obtained from trusted, fully controlled sources, and avoid calling Predictor.deserialize() or RepresentablePredictor.deserialize() on model directories that are not fully controlled. The upstream project has addressed this issue in GluonTS 0.17.0, and upgrading to a version containing that fix resolves the issue; for Red Hat OpenShift AI, fixes are being pursued through the product's update streams.
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 7.8 | N/A | 7.8 |
| Attack Vector | Local | N/A | Local |
| Attack Complexity | Low | N/A | Low |
| Privileges Required | None | N/A | None |
| User Interaction | Required | N/A | Required |
| Scope | Unchanged | N/A | Unchanged |
| Confidentiality | High | N/A | High |
| Integrity Impact | High | N/A | High |
| Availability Impact | High | N/A | High |
Vector
Red Hat: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
cve.org: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
