Bug 2494203 (CVE-2026-13717)

Summary: CVE-2026-13717 RHOAI MaaS: llm-d: MaaS/llm-d inference Gateway: default allowedRoutes.namespaces.from: All allows namespace users to hijack shared model-serving traffic (tokens, prompts, outputs)
Product: [Other] Security Response Reporter: OSIDB Bzimport <bzimport>
Component: vulnerabilityAssignee: Product Security <prodsec-ir-bot>
Status: NEW --- QA Contact:
Severity: high Docs Contact:
Priority: high    
Version: unspecifiedCC: jkoehler, lphiri, security-response-team
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: ---
Doc Text:
A flaw was found in the Red Hat OpenShift AI (RHOAI) MaaS Gateway. Improper configuration of the Gateway in a model-serving context allows a standard user with low privileges to intercept, read, log, and alter all MaaS model traffic. This includes sensitive information such as access keys, input prompts, and outputs, leading to significant information disclosure and data tampering.
 Story Points: ---
Clone Of: Environment:
Last Closed: Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:

Description OSIDB Bzimport 2026-06-29 14:05:00 UTC 
Current MaaS architecture, documentation and examples still fails to adequately convey the complexities and security risks involved in configuring the Gateway in a model-serving context. 

This affects any model served with MaaS and/or llm-d. Both Red Hat and Customer environments are likely highly vulnerable. A user with standard permissions can intercept, read, log, and alter all MaaS model traffic (including access keys, input prompts, and outputs).
A standard user in a namespace authorized to use the MaaS Gateway (which is any namespace in our default configuration and all the examples) can easily hijack any traffic going through MaaS. Same applied to llm-s.