Red Hat OpenShift AI: an eval job's model URL leaks the tenant's API key

01What happened

Red Hat made CVE-2026-17557 public on 21 October 2026, a flaw in the lm-evaluation-harness component of Red Hat OpenShift AI. A Red Hat Product Security audit found it during an internal review tracked as Glasswing and filed it in the product's bug tracker on 27 July 2026. Red Hat rates the flaw Moderate, with a CVSS base score of 6.5.

02How it works

The EvalHub adapter builds the completions URL from the model.url field of the evaluation job spec, with no allow-list for the host or scheme and no block on internal addresses. Red Hat's job exports the tenant's model API key as OPENAI_API_KEY and sends it to that URL as a Bearer token. A user who can submit a job can therefore point the request at a listener they control and collect the credential, or aim it at internal and link-local endpoints reachable from the evaluation pod for blind server-side request forgery.

03Who is affected

Red Hat states the flaw is specific to Red Hat OpenShift AI 3.4 and its odh-ta-lmes-job-rhel9 package, used with eval-hub. Exploitation needs an authenticated account that is allowed to submit an evaluation job, so the exposure sits with tenants and insiders rather than anonymous callers. Red Hat's record lists the fix state for the 3.4 package itself as deferred.

04What to do

Move to Red Hat OpenShift AI 3.5, which Red Hat says addresses the issue through an architectural change, because its record names no fix for 3.4 and no mitigation. Until that upgrade lands, restrict who may submit evaluation jobs and rotate any model provider key that a 3.4 evaluation job could read.

Sources 3 links, all fetched

1. 1access.redhat.comRed Hat Advisory
2. 2github.comGitHub Advisory
3. 3bugzilla.redhat.comRed Hat Bugzilla