{"resourceId":"redhat-ai-base-images-brotli-kev-batch-20261103","versions":[{"version":"external-a51871d9f8dcbbd04627586ed3258dd35c70d7e8790a2effa9ee9a2e8b509f61","resource":{"id":"redhat-ai-base-images-brotli-kev-batch-20261103","title":"Red Hat ships 18 OpenShift AI base-image advisories carrying the KEV-listed Brotli fix, but the CUDA MLServer image is still Affected","organization":"Red Hat Product Security","sector":"AI platform software used by public and private sectors (Red Hat OpenShift AI)","geography":"Global product advisory; applies to any US SLED deployment of OpenShift AI 3.0, 3.4 or 3.5","publishedAt":"RHSA-2026:94452 to 94469 issued Nov. 3, 2026; CVE public Oct. 22, 2026; CISA KEV listing Oct. 27, 2026","publicationDate":"2026-11-03","eventDate":"2026-11-03","sourceName":"Red Hat Customer Portal (errata)","sourceLabel":"RHSA-2026:94459 - Red Hat AI Base Images 3.0.8 (CPU) (Critical)","sourceUrl":"https://access.redhat.com/errata/RHSA-2026:94459","evidenceClass":"vendor-claim","outcomeClass":"cautionary","topics":["infrastructure","data-security","operating-model"],"finding":"Vendor record: on Nov. 3, 2026 Red Hat issued 18 advisories (RHSA-2026:94452 to 94469) updating Red Hat AI Base Images for OpenShift AI 3.0, 3.4 and 3.5 across CPU, CUDA 12.9/13.0, ROCm, Gaudi, Neuron, Spyre and TPU. Every listed image picks up CVE-2026-111497, the Brotli decoder flaw; the 3.0.8 CPU image is rated Critical and lists 25 CVEs, and the CUDA 13.0 image (also Critical) lists 23. Red Hat's security data, checked the same evening, still shows the odh-mlserver-cuda serving image as Affected. Independent evidence: CISA lists the flaw as known-exploited, federal due date Nov. 10. Interpretation: this widens the Nov. 2 fix from one service image to the base images most custom workbenches and serving runtimes build on.","sledRelevance":"Universities, research computing centers and state agencies that build custom notebooks or model-serving containers on Red Hat AI base images need to rebuild on the Nov. 3 digests, not just upgrade the OpenShift AI operator. Many states and campuses use the KEV list to set patch priority even though its deadline binds only federal agencies.","evidence":"Read RHSA-2026:94459 and RHSA-2026:94468, the Red Hat security data JSON for CVE-2026-111497 (18 Nov. 3 affected_release entries and package states) and the CISA KEV feed entry.","architectureImplications":"Base images sit under derived images, so fixes reach production only when downstream workbench, pipeline and serving images are rebuilt and redeployed. Image pinning by digest makes this visible; floating tags can hide stale layers.","governanceImplications":"A dated KEV deadline plus vendor fixes gives an auditable trigger. The still-Affected CUDA MLServer image needs a documented, time-boxed exception.","securityPrivacyImplications":"Red Hat and CISA describe memory disclosure, denial of service or possible code execution from crafted Brotli streams. In AI containers that could expose prompts, documents or model artifacts. The 25-CVE CPU image also carries other bundled-library fixes not described individually.","caveats":"Vendor self-assessment with terse advisories; the reason for the Critical rating is not stated. Package states were observed once (Nov. 3 evening CT) and may change. KEV does not say exploitation targeted AI platforms.","streamIds":["red-hat"],"roles":{"sales":"Sales framing: a hygiene and trust conversation. OpenShift AI customers in state agencies and universities should hear that Red Hat's Nov. 3 batch moves the KEV-listed Brotli fix into the AI base images, but one GPU serving image still shows Affected. Offer a short image-rebuild review tied to the Nov. 10 KEV date. Interpretation only: do not claim the platform is fully patched, that the flaw was exploited through AI workloads, or that the Critical rating reflects a specific AI risk.","engineering":"Engineering framing: operator upgrades are not enough. Find every workbench, pipeline and serving image derived from rhai base images, rebuild on the Nov. 3 digests and redeploy, then compare digests against the advisories. Treat odh-mlserver-cuda as still Affected and strip or reject Content-Encoding: br from untrusted clients at ingress until it is fixed. Verify by re-checking Red Hat package states and scanning rebuilt images. Applicability is limited to sites using these images.","delivery":"Delivery framing: run a short rebuild sprint with a KEV-dated tracker. Inventory derived images and their base digests, rebuild and redeploy in priority order (internet-facing serving first), and record exceptions for images still Affected. The platform team owns execution and the security office owns exceptions. Proposed close criteria: no running image on a pre-Nov. 3 base, and every exception signed and time-boxed. Interpretation, not an observed result."},"roleDetails":{"sales":{"customerProblem":"OpenShift AI customers may not realize that base-image advisories require rebuilding their own derived images.","stakeholders":["Agency or campus CISO","Research computing director","AI platform owner"],"discoveryQuestions":["Which notebooks and serving runtimes are built on Red Hat AI base images?","Are images pinned by digest or floating tags?","Who approves security exceptions for unfixed images?"],"valueHypothesis":"A focused rebuild review can shorten exposure to a known-exploited flaw across AI workloads; the size of that reduction is unmeasured.","potentialEngagement":"Short (1 to 2 week) base-image inventory and rebuild review tied to the KEV date.","unsupportedClaims":["The platform is fully patched","The flaw was exploited against AI workloads","Guaranteed risk reduction or cost savings"]},"engineering":{"fit":"Relevant to any OpenShift AI 3.0, 3.4 or 3.5 deployment using rhai base images for custom workbenches or serving.","architectureIntegration":"Hook base-image digest changes into CI rebuild triggers; enforce digest pinning and admission checks for stale bases.","prerequisites":["Image inventory with base-image lineage","Rebuild pipeline access","Registry access to registry.redhat.io"],"constraints":["CUDA MLServer image still Affected","Air-gapped sites must mirror new digests","KEV deadline binds only federal civilian agencies"],"security":"Rebuild on fixed bases; reject or strip br encoding from untrusted clients for still-Affected images; rescan rebuilt images.","proofOfValue":["Digest comparison of running images against the Nov. 3 advisories","Scanner confirms CVE-2026-111497 absent in rebuilt images","Ingress test rejects Content-Encoding: br"]},"delivery":{"work":"Inventory, rebuild and redeploy AI images on fixed bases; manage exceptions for images without fixes.","dependencies":["CI/CD rebuild pipelines","Change windows for serving endpoints","Security office for exceptions"],"ownership":"AI platform team, with the security office owning exceptions.","skillsAdoption":"Train platform staff to trace image lineage and read Red Hat security data package states.","governanceCheckpoints":["Inventory sign-off","Exception approval for still-Affected images","Post-rebuild scan review"],"acceptanceCriteria":["Proposed: 100% of running AI images on Nov. 3 or later base digests","Proposed: exceptions documented for every still-Affected image","Proposed: ingress br controls verified where exceptions apply"],"risks":["Floating tags hide stale layers","Rebuilds break pinned Python dependencies","Vendor package states change after review"]}},"retrievedAt":"2026-11-04T04:09:30Z","enrichedAt":"2026-11-04T04:12:29Z","enrichmentBasis":"retrieved source","accessibilityWorkforceImplications":"Needs staff who can trace derived images to base-image digests and run rebuild pipelines. Smaller campus or county teams may need partner help.","procurementImplications":"Support contracts for self-hosted AI platforms should cover base-image rebuild guidance and reporting on images that remain unfixed after a KEV listing.","operatingModelImplications":"AI platform security is a supply-chain task: image rebuild cadence matters as much as operator upgrades.","sourceVerification":{"openedUrl":"https://access.redhat.com/errata/RHSA-2026:94459","referenceExcerpt":"Red Hat AI Base Images 3.0.8 (CPU) is now available.","promptVersion":"sled-research-v4.0","model":null,"basis":"agent-reported inspection"}}}]}