A high-severity information disclosure vulnerability in Red Hat OpenShift AI (RHOAI) poses a significant risk of unauthorized data access.

This vulnerability is an instance of CWE-538, involving the insertion of sensitive information into an externally accessible file or directory. The vulnerability is exploitable by an unauthenticated remote attacker with low complexity.

Successful exploitation allows an attacker to retrieve sensitive information that should remain protected, potentially leading to unauthorized data exposure. Given the CVSS score of 7.5, this is classified as a High severity issue. The compromise of such data could have significant implications for system integrity and organizational security, depending on the nature of the information exposed by the gateway component.

Immediate Action: Monitor the Red Hat Security Advisory portal for the release of security patches and apply updates to the RHOAI environment immediately upon availability.

Proactive Monitoring: Review access logs for the vllm-orchestrator-gateway for anomalous patterns or unauthorized requests that may indicate exploitation attempts.

Compensating Controls: Implement strict network ingress controls and utilize a Web Application Firewall (WAF) to restrict access to the gateway component to known, trusted IP ranges.

Public Exploit Available: Unknown

Organizations utilizing Red Hat OpenShift AI should prioritize the monitoring of official Red Hat security channels. As this vulnerability involves sensitive information exposure, immediate patching is required once the vendor provides a remediation path to prevent potential data breaches.