{"id":"CVE-2026-17557","kind":"vulnerability","aliases":["CVE-2026-17557"],"related":[],"title":"Red Hat OpenShift AI: evaluation job leaks model secret and enables SSRF","description":"A flaw was found in the `lm-evaluation-harness` component of Red Hat OpenShift AI. An authenticated user, able to submit an evaluation job, could exploit this by providing a malicious model URL in the `JobSpec`. This vulnerability allows for the disclosure of the tenant's model authentication secret to an attacker-controlled external listener. Additionally, it enables Server-Side Request Forgery (SSRF) attacks against internal network endpoints reachable from the evaluation job pod.","summary":"An authenticated user who submits an evaluation job can point its model URL at an external listener, causing the tenant's model authentication secret to be sent there. The same job can also be used to make server-side requests to internal network endpoints reachable from the evaluation pod.","severity":"medium","cvss":6.5,"epss":0.00258,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["ai-tooling","kubernetes","lm-evaluation-harness","multi-tenant","openshift-ai"],"not_affected_if":["no-evaluation-jobs"],"how_to_check":"- unknown","fix":"- unknown","status":"open","published_at":"2026-10-21T08:16:43+00:00","first_seen_at":"2026-10-23T21:57:28+00:00","triaged_at":"2026-10-25T03:49:05+00:00","updated_at":"2026-10-25T03:49:05+00:00","category":"ai-tooling","confidence":0.6,"triage":{"at":"2026-10-25T03:49:05Z","model":"claude-haiku-5-5","output":{"fix":"- unknown","reach":"network","title":"Red Hat OpenShift AI: evaluation job leaks model secret and enables SSRF","impact":"medium","summary":"An authenticated user who submits an evaluation job can point its model URL at an external listener, causing the tenant's model authentication secret to be sent there. The same job can also be used to make server-side requests to internal network endpoints reachable from the evaluation pod.","category":"ai-tooling","nicknames":[],"who_cares":["openshift-ai","kubernetes","lm-evaluation-harness","multi-tenant"],"confidence":0.6,"needs_auth":"yes","worst_case":"Tenant model secret leaks to external host; internal endpoints reachable via SSRF","analyst_note":"Find the affected and fixed OpenShift AI versions and the Red Hat advisory from the NVD entry (https://nvd.nist.gov/vuln/detail/CVE-2026-17557).","how_to_check":"- unknown","needs_analyst":true,"not_affected_if":["no-evaluation-jobs"],"who_is_affected":"Teams running Red Hat OpenShift AI with the lm-evaluation-harness evaluation feature, where multiple users can submit evaluation jobs. The sources do not name affected versions. Teams that do not run OpenShift AI evaluation jobs can skip it.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000595,"input_tokens":3420,"output_tokens":506,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-17557':15A,18A '-2026':14A,17A 'abl':102C 'addit':140C 'ai':4A,20B,32B,98C 'ai-tool':19B 'allow':122C 'also':65B 'attack':136C,149C 'attacker-control':135C 'authent':34B,55B,100C,131C 'caus':50B 'compon':93C 'control':137C 'could':108C 'cve':13A,16A 'disclosur':125C 'enabl':11A,142C 'endpoint':77B,153C 'evalu':5A,25B,39B,81B,91C,106C,157C 'exploit':109C 'extern':48B,138C 'flaw':84C 'forgeri':147C 'found':86C 'har':26B,92C 'hat':2A,96C 'intern':75B,151C 'job':6A,40B,63B,107C,158C 'jobspec':119C 'kubernet':22B 'leak':7A 'listen':49B,139C 'lm':24B,90C 'lm-evaluation-har':23B,89C 'make':69B 'malici':114C 'model':8A,44B,54B,115C,130C 'multi':28B 'multi-ten':27B 'network':76B,152C 'openshift':3A,31B,97C 'openshift-ai':30B 'pod':82B,159C 'point':42B 'provid':112C 'reachabl':78B,154C 'red':1A,95C 'request':73B,146C 'secret':9A,56B,132C 'sent':59B 'server':71B,144C 'server-sid':70B,143C 'side':72B,145C 'ssrf':12A,148C 'submit':37B,104C 'tenant':29B,52B,128C 'tool':21B 'url':45B,116C 'use':67B 'user':35B,101C 'vulner':121C","nicknames":[],"mitigations":[],"who_affected":"Teams running Red Hat OpenShift AI with the lm-evaluation-harness evaluation feature, where multiple users can submit evaluation jobs. The sources do not name affected versions. Teams that do not run OpenShift AI evaluation jobs can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-21T08:16:43+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","cvss_by":"secalert@redhat.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-17557","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-17557","severity":null,"published_at":"2026-10-21T08:16:43+00:00","modified_at":"2026-10-22T15:25:35+00:00","first_seen_at":"2026-10-23T21:57:28+00:00","fetched_at":"2026-10-23T22:29:01+00:00","note":null},{"source":"epss","external_id":"CVE-2026-17557","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-17557","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-24T13:15:54+00:00","fetched_at":"2026-10-24T13:15:54+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}