CVE-2026-17557

MediumCVSS 6.5/10Last modified Oct 22, 2026

Description

A flaw was found in the `lm-evaluation-harness` component of Red Hat OpenShift AI. An authenticated user, able to submit an evaluation job, could exploit this by providing a malicious model URL in the `JobSpec`. This vulnerability allows for the disclosure of the tenant's model authentication secret to an attacker-controlled external listener. Additionally, it enables Server-Side Request Forgery (SSRF) attacks against internal network endpoints reachable from the evaluation job pod.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-918

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

No affected versions have been published.

Timeline

Published: Oct 21, 2026
Last modified: Oct 22, 2026
NVD status: Awaiting Analysis

Related CVEs from 2026

CVE-2026-175595.3The Passster WordPress plugin before 4.3.9 does not correctly match its own public endpoint paths when deciding which REST API requests may CVE-2026-17568.8The WP FOFT Loader plugin for WordPress is vulnerable to arbitrary file uploads due to incorrect file type validation in the 'WP_FOFT_Loader CVE-2026-175619.8Improper Control of Generation of Code ('Code Injection') vulnerability in Innotim Software, Telecommunications and Consulting Trade Ltd. Co CVE-2026-175626.5Authorization bypass through User-Controlled key vulnerability in Summit Security Systems AdisyonPro allows Accessing Functionality Not Prop CVE-2026-175635.3The User Frontend WordPress plugin before 4.3.11 does not enforce its subscription-purchase requirement when processing frontend post submis CVE-2026-175657.2The Animation Addons for Elementor WordPress plugin before 2.7.2 does not validate a user-supplied value before using it to build the host CVE-2026-175669.9pgAdmin 4's Import/Export Data tool builds a psql \copy (...) command line by interpolating a user-supplied SQL query into a Jinja template CVE-2026-175675.3The Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder plugin for WordPress is vulnerable to Insecure Di CVE-2026-175688.8Improper access control in the role membership management endpoint in Devolutions Server allows an authenticated non-administrative user hol CVE-2026-175694.3Improper access control in the NetBox synchronizer in Devolutions Server allows an authenticated user with view-only permission on an entry CVE-2026-17576.2A flaw was identified in the interactive shell of the xmllint utility, part of the libxml2 project, where memory allocated for user input is CVE-2026-175704.3Improper access control in the PAM password history endpoints in Devolutions Server allows an authenticated low-privileged user to disclose