A critical vulnerability in Red Hat OpenShift AI allows unauthorized cross-namespace access to Llama Stack instances, potentially exposing sensitive data to other authenticated users.

The flaw, categorized as Improper Isolation or Compartmentalization (CWE-653), stems from a lack of NetworkPolicy enforcement on the llama-stack service endpoint. An authenticated user within the cluster can perform direct network requests to interact with or manipulate Llama Stack instances deployed in namespaces they should not be able to access.

The ability for a user to bypass namespace isolation poses a significant risk to data confidentiality and integrity within multi-tenant AI environments. With a CVSS score of 8.1, this high-severity flaw could lead to the unauthorized viewing or modification of sensitive AI model data, resulting in potential compliance violations and loss of intellectual property.

Immediate Action: Update to the fixed container image versions specified in the Red Hat Security Advisory (RHSA-2026:2106 and RHSA-2026:2695), ensuring your deployment uses the corrected SHA-256 hashes.

Proactive Monitoring: Review cluster network traffic logs for unexpected inter-namespace communication patterns originating from user-controlled pods toward the llama-stack service.

Compensating Controls: Implement strict NetworkPolicies to explicitly deny ingress traffic to the llama-stack service from unauthorized namespaces until the patch can be fully deployed.

Public Exploit Available: No (exploit_available: false)

Given the potential for unauthorized access to sensitive AI infrastructure, administrators should prioritize the deployment of the updated container images provided by Red Hat. Ensuring that namespace isolation is enforced via NetworkPolicies is a critical step in maintaining the security posture of your OpenShift AI deployment.