Vulnerability in Red Hat Openshift Ai (Rhoai)
CVE-2026-13717
A flaw was found in the Red Hat OpenShift AI (RHOAI) MaaS Gateway. Improper configuration of the Gateway in a model-serving context allows a standard user with low privileges to intercept, read, log, and alter all MaaS model traffic. This includes sensitive information such as access keys, input prompts, and outputs, leading to significant information disclosure and data tampering.
Published · last modified .
CVSS v3 metric
CVSS v3 base score 8.8 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H.
EPSS exploit prediction
EPSS: 0.005 (42.6th percentile), scored .
Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 43rd percentile — 42.6% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.004 · newest: 0.005 · change: +0.002
Affected products
Weakness classification (CWE)
References
- access.redhat.com/security/cve/CVE-2026-13717 (vdb-entry)
- bugzilla.redhat.com/show_bug.cgi (issue-tracking)
- access.redhat.com/errata/RHSA-2026:53262 (vendor-advisory)
- access.redhat.com/errata/RHSA-2026:60520 (vendor-advisory)
Frequently asked questions
- What is CVE-2026-13717?
- CVE-2026-13717 is a high-severity vulnerability in Red Hat Openshift Ai (Rhoai), classified under Improper Access Control. CVSS score: 8.8/10. Published 2026-08-10.
- How severe is CVE-2026-13717?
- High severity. CVSS v3 base score is 8.8 out of 10.