{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-17557", "assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749", "state": "PUBLISHED", "assignerShortName": "redhat", "dateReserved": "2026-07-27T13:25:28.561Z", "datePublished": "2026-10-21T07:59:10.543Z", "dateUpdated": "2026-10-21T13:38:59.538Z"}, "containers": {"cna": {"title": "Lm-evaluation-harness: lm-evaluation-harness: ssrf via job-spec model.url with bearer credential forwarding", "metrics": [{"other": {"content": {"value": "Moderate", "namespace": "https://access.redhat.com/security/updates/classification/"}, "type": "Red Hat severity rating"}}, {"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "version": "3.1"}, "format": "CVSS"}], "descriptions": [{"lang": "en", "value": "A flaw was found in the `lm-evaluation-harness` component of Red Hat OpenShift AI. An authenticated user, able to submit an evaluation job, could exploit this by providing a malicious model URL in the `JobSpec`. This vulnerability allows for the disclosure of the tenant's model authentication secret to an attacker-controlled external listener. Additionally, it enables Server-Side Request Forgery (SSRF) attacks against internal network endpoints reachable from the evaluation job pod."}], "affected": [{"vendor": "Red Hat", "product": "Red Hat OpenShift AI (RHOAI)", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "packageName": "rhoai/odh-ta-lmes-job-rhel9", "defaultStatus": "affected", "cpes": ["cpe:/a:redhat:openshift_ai"]}], "references": [{"url": "https://access.redhat.com/security/cve/CVE-2026-17557", "tags": ["vdb-entry", "x_refsource_REDHAT"]}, {"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2507452", "name": "RHBZ#2507452", "tags": ["issue-tracking", "x_refsource_REDHAT"]}], "datePublic": "2026-10-21T06:53:43.322Z", "problemTypes": [{"descriptions": [{"cweId": "CWE-918", "description": "Server-Side Request Forgery (SSRF)", "lang": "en", "type": "CWE"}]}], "x_redhatCweChain": "CWE-918: Server-Side Request Forgery (SSRF)", "timeline": [{"lang": "en", "time": "2026-06-18T14:22:24.892Z", "value": "Reported to Red Hat."}, {"lang": "en", "time": "2026-10-21T06:53:43.322Z", "value": "Made public."}], "providerMetadata": {"orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749", "shortName": "redhat", "dateUpdated": "2026-10-21T07:59:10.543Z"}, "x_generator": {"engine": "cvelib 1.8.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-10-21T13:38:43.230972Z", "id": "CVE-2026-17557", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-21T13:38:59.538Z"}}]}}

{}

{"affected": [{"affectedData": [{"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:openshift_ai"], "defaultStatus": "affected", "packageName": "rhoai/odh-ta-lmes-job-rhel9", "product": "Red Hat OpenShift AI (RHOAI)", "vendor": "Red Hat"}], "source": "secalert@redhat.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "A flaw was found in the `lm-evaluation-harness` component of Red Hat OpenShift AI. An authenticated user, able to submit an evaluation job, could exploit this by providing a malicious model URL in the `JobSpec`. This vulnerability allows for the disclosure of the tenant's model authentication secret to an attacker-controlled external listener. Additionally, it enables Server-Side Request Forgery (SSRF) attacks against internal network endpoints reachable from the evaluation job pod."}], "id": "CVE-2026-17557", "lastModified": "2026-10-22T15:25:35.333", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 3.6, "source": "secalert@redhat.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-17557", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-10-21T13:38:43.230972Z", "version": "2.0.3"}}]}, "published": "2026-10-21T08:16:43.090", "references": [{"source": "secalert@redhat.com", "url": "https://access.redhat.com/security/cve/CVE-2026-17557"}, {"source": "secalert@redhat.com", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2507452"}], "sourceIdentifier": "secalert@redhat.com", "vulnStatus": "Awaiting Analysis", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-918"}], "source": "secalert@redhat.com", "type": "Secondary"}]}

{"bugzilla": {"description": "lm-evaluation-harness: lm-evaluation-harness: SSRF via job-spec model.url with bearer credential forwarding", "id": "2507452", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2507452"}, "csaw": false, "cvss3": {"cvss3_base_score": "6.5", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "status": "draft"}, "cwe": "CWE-918", "details": ["A flaw was found in the `lm-evaluation-harness` component of Red Hat OpenShift AI. An authenticated user, able to submit an evaluation job, could exploit this by providing a malicious model URL in the `JobSpec`. This vulnerability allows for the disclosure of the tenant's model authentication secret to an attacker-controlled external listener. Additionally, it enables Server-Side Request Forgery (SSRF) attacks against internal network endpoints reachable from the evaluation job pod."], "name": "CVE-2026-17557", "package_state": [{"cpe": "cpe:/a:redhat:openshift_ai", "fix_state": "Fix deferred", "package_name": "rhoai/odh-ta-lmes-job-rhel9", "product_name": "Red Hat OpenShift AI (RHOAI)"}], "public_date": "2026-10-21T06:53:43Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-17557\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-17557"], "statement": "Moderate: A Server-Side Request Forgery (SSRF) vulnerability exists in Red Hat OpenShift AI (RHOAI) 3.4's lm-evaluation-harness. An authenticated user can craft a malicious `model.url` in an EvalHub evaluation job, leading to the disclosure of the tenant's model-auth secret to an arbitrary external host or enabling blind SSRF attacks against internal network endpoints. This issue is specific to RHOAI 3.4 and has been addressed in RHOAI 3.5 by an architectural change.", "threat_severity": "Moderate"}