Critical Vulnerability in Red Hat OpenShift AI Threatens Full Infrastructure Takeover

Critical Vulnerability Discovered in Red Hat OpenShift AI

A severe security flaw has been uncovered in Red Hat's OpenShift AI service, potentially exposing hybrid cloud environments to significant risks. The vulnerability, tracked as CVE-2025-10725, has been assigned a near-maximum severity score of 9.9 out of 10 .

Vulnerability Details and Impact

The flaw allows a low-privileged attacker with access to an authenticated account, such as a data scientist using a standard Jupyter notebook, to escalate their privileges to that of a full cluster administrator . This escalation can lead to a complete compromise of the cluster's confidentiality, integrity, and availability.

Red Hat has classified the vulnerability as "Important" rather than "Critical," citing the requirement for some level of authentication for exploitation . However, the potential consequences are severe, including:

1. Theft of sensitive data
2. Disruption of all services
3. Full control over the underlying infrastructure
4. Total breach of the platform and hosted applications

Technical Explanation

The vulnerability stems from an incorrect binding of the "kueue-batch-user-role" ClusterRole to the system:authenticated group . This misconfiguration grants any authenticated entity, including low-privileged service accounts for user workbenches, permission to create OpenShift Jobs in any namespace .

An attacker could exploit this by scheduling a malicious job in a privileged namespace, configuring it to run with a high-privilege ServiceAccount, and exfiltrating that ServiceAccount token. This process allows for progressive pivoting and compromise of more powerful accounts, potentially leading to root access on cluster master nodes and full cluster takeover .

Mitigation Strategies

Red Hat has provided several mitigation strategies for affected users:

1. Remove the ClusterRoleBinding that links the kueue-batch-user-role ClusterRole with the system:authenticated group .
2. Grant permissions to create jobs on a more granular, as-needed basis to specific users or groups .
3. Avoid granting broad permissions to system-level groups .

Related Stories

BadHost Vulnerability in Starlette Framework Puts Millions of AI Agents at Critical Risk

Critical Security Flaws Discovered in NVIDIA Container Toolkit

Chainlit AI framework vulnerabilities expose enterprise clouds to data theft and takeover

AI Agents Hijacked via Prompt Injection: Bug Bounties Paid, Security Advisories Withheld

Expert Recommendations

Trey Ford, chief strategy and trust officer at Bugcrowd, emphasizes the urgency of addressing this vulnerability:

"Administrators managing OpenShift AI infrastructure need to patch this with a sense of urgency - this is a delightful vulnerability pattern for attackers looking to acquire both access and data," Ford stated .

He further advises organizations to "assume breach" and conduct thorough investigations to confirm whether their clusters have been compromised .

Affected Versions and Broader Implications

The vulnerability affects multiple versions of Red Hat OpenShift AI, highlighting the importance of prompt patching and security reviews across hybrid cloud environments . As AI and machine learning technologies become increasingly integrated into enterprise infrastructure, vulnerabilities like CVE-2025-10725 underscore the critical need for robust security measures in AI-driven platforms.