CVE-2026-119990
Description
A missing authentication flaw was found in Microsoft's Azure OpenAI hosted cloud service. An unauthenticated remote attacker could invoke a critical function of the service, resulting in an elevation of privilege over a network. This vulnerability exists in Microsoft's cloud service only; the openai-go client SDK (github.com/openai/openai-go/v3/azure) bundled in some Red Hat products does not contain the vulnerable code and is not affected. Microsoft has remediated this issue service-side and states that no customer action is required.
Statement
Azure OpenAI is an external hosted service operated by Microsoft, and the vulnerability described in CVE-2026-119990 exists in that service rather than in any software distributed by Red Hat. The github.com/openai/openai-go/v3/azure module referenced in Red Hat SBOMs is a client-side SDK that only provides connection and authentication configuration helpers for applications calling the Azure OpenAI API; it does not implement any server-side functionality, so the vulnerable code is not present in any Red Hat product that ships it. Microsoft has stated that this issue was fully mitigated service-side and that no customer action is required. Consequently, Red Hat offerings, including those that bundle the openai-go SDK as a transitive dependency, are not affected by this vulnerability.
Mitigation
This vulnerability affects Microsoft's Azure OpenAI hosted service and was remediated by Microsoft service-side (fixed in Azure OpenAI build hyena-infra-build-official/20260923.14). No action is required for Red Hat products that bundle the openai-go client SDK; there is no vulnerable code on the Red Hat side to patch or mitigate.
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
The following CVSS metrics and score provided are preliminary and subject to review.
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 9.8 | N/A | 9.8 |
| Attack Vector | Network | N/A | Network |
| Attack Complexity | Low | N/A | Low |
| Privileges Required | None | N/A | None |
| User Interaction | None | N/A | None |
| Scope | Unchanged | N/A | Unchanged |
| Confidentiality | High | N/A | High |
| Integrity Impact | High | N/A | High |
| Availability Impact | High | N/A | High |
Vector
Red Hat: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
cve.org: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
Understanding the Weakness (CWE)
Access Control,Other
Technical Impact: Gain Privileges or Assume Identity; Varies by Context
Exposing critical functionality essentially provides an attacker with the privilege level of that functionality. The consequences will depend on the associated functionality, but they can range from reading or modifying sensitive data, accessing administrative or other privileged functionality, or possibly even executing arbitrary code.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
