CVE-2025-10725

Published Sep 30, 2025

Last updated a month ago

Overview

AI description

Automated description summarized from trusted sources.

CVE-2025-10725 is a vulnerability found in Red Hat OpenShift AI (RHOAI). It stems from an overly permissive ClusterRole assignment that links the built-in system: authenticated group to the kueue-batch-user-role. This misconfiguration allows any authenticated user broad job-creation rights across the cluster. A low-privileged attacker with an authenticated account, like a data scientist using a standard Jupyter notebook, can exploit this flaw to gain full cluster administrator privileges. Once elevated, the attacker can compromise the cluster's confidentiality, integrity, and availability, potentially stealing sensitive data, disrupting services, and controlling the underlying infrastructure.

Description: A flaw was found in Red Hat Openshift AI Service. A low-privileged attacker with access to an authenticated account, for example as a data scientist using a standard Jupyter notebook, can escalate their privileges to a full cluster administrator. This allows for the complete compromise of the cluster's confidentiality, integrity, and availability. The attacker can steal sensitive data, disrupt all services, and take control of the underlying infrastructure, leading to a total breach of the platform and all applications hosted on it.
Source: secalert@redhat.com
NVD status: Received

Risk scores

CVSS 3.1

Type: Secondary
Base score: 9.9
Impact score: 6
Exploitability score: 3.1
Vector string: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Severity: CRITICAL

Weaknesses

secalert@redhat.com: CWE-266

Hype score: Not currently trending

References