{"resourceId":"redhat-rhsa-2026-93550-openshift-ai-brotli-kev-fix-20261102","versions":[{"version":"external-597ac88da4ba5530ddaf090fd7ec51f56a408d17593b69ce73b2441703487344","resource":{"id":"redhat-rhsa-2026-93550-openshift-ai-brotli-kev-fix-20261102","title":"Red Hat ships a second OpenShift AI 3.4.6 fix for the KEV-listed Brotli flaw, but one model-serving image remains Affected","organization":"Red Hat Product Security","sector":"AI platform software used by public and private sectors (Red Hat OpenShift AI)","geography":"Global product advisory; applies to any US SLED deployment of OpenShift AI 3.4","publishedAt":"RHSA-2026:93550 issued Nov. 2, 2026; CVE public Oct. 22, 2026; CISA KEV listing Oct. 27, 2026","publicationDate":"2026-11-02","eventDate":"2026-11-02","sourceName":"Red Hat Customer Portal (errata)","sourceLabel":"RHSA-2026:93550 - RHOAI 3.4.6 (Important)","sourceUrl":"https://access.redhat.com/errata/RHSA-2026:93550","evidenceClass":"vendor-claim","outcomeClass":"cautionary","topics":["infrastructure","data-security","operating-model"],"finding":"Vendor record: on Nov. 2, 2026 Red Hat issued RHSA-2026:93550 (Important) with updated OpenShift AI 3.4.6 TrustyAI service images fixing CVE-2026-111497, an out-of-bounds write in the Google Brotli decoder (Red Hat CVSS 8.1). It follows RHSA-2026:92510 (Oct. 29) for the MLServer image. Red Hat's security data, checked the same night, still lists the odh-mlserver-cuda image as Affected. Independent evidence: CISA added the flaw to its Known Exploited Vulnerabilities catalog on Oct. 27 with a Nov. 10 federal due date. Interpretation: OpenShift AI 3.4 customers need the full 3.4.6 image set, plus a check of GPU serving images.","sledRelevance":"State agencies, universities and research computing centers running OpenShift AI 3.4 on premises process untrusted HTTP traffic and data, so a known-exploited decoder flaw in AI platform images is an immediate patching item. KEV deadlines bind only federal civilian agencies, but many states and campuses use KEV to set patching priority.","evidence":"Read RHSA-2026:93550 and RHSA-2026:92510, the Red Hat security data JSON for CVE-2026-111497 (affected releases and package states), Red Hat bulletin RHSB-2026-015 and the CISA KEV JSON feed entry.","architectureImplications":"Exposure depends on whether a component decompresses attacker-controlled Brotli data, for example HTTP Content-Encoding: br at ingress or Node.js decoders. Reverse proxies and gateways in front of model-serving and TrustyAI endpoints can strip or reject br until images are updated.","governanceImplications":"KEV listing plus a vendor fix creates an auditable deadline. Images still marked Affected need a documented risk exception with compensating controls.","securityPrivacyImplications":"Red Hat says a successful exploit could disclose memory, crash the service or possibly run code. In AI serving containers, that could expose prompts, documents or model artifacts. Red Hat notes high attack complexity and that hardening reduces but does not eliminate the risk.","caveats":"Vendor self-assessment; fix states observed once (Nov. 2 to 3 UTC) and may change. CISA KEV does not say exploitation has targeted AI platforms. Red Hat release-note docs were still pending update. Severity labels differ by source: the Oct. 29 advisory is labeled Critical, while the Nov. 2 advisory and the CVE are Important.","streamIds":["red-hat"],"roles":{"sales":"Sales framing: a trust and hygiene conversation, not a product pitch. OpenShift AI 3.4 customers in state agencies and universities should hear that Red Hat has shipped two 3.4.6 advisories for a known-exploited Brotli flaw, that one GPU serving image still shows Affected, and that a short check confirms where they stand. Offer an exposure review tied to the KEV date. Do not claim the platform is now fully patched, or that it was ever exploited through AI workloads.","engineering":"Engineering framing: confirm image digests, not just the operator version. Compare deployed TrustyAI and MLServer images against RHSA-2026:93550 and RHSA-2026:92510, and flag odh-mlserver-cuda as still Affected. Until it is fixed, strip or reject Content-Encoding: br from untrusted clients at the ingress or gateway, and avoid decoding user-supplied Brotli in Node.js components. Verify by re-checking Red Hat package states and testing that ingress rejects br requests.","delivery":"Delivery framing: run it as a short remediation sprint with a KEV-dated tracker. Inventory OpenShift AI clusters and image digests, upgrade to the complete 3.4.6 set, apply ingress br controls where images are still Affected, and record risk exceptions. The platform team owns execution and the security office owns exceptions. Close when every image is fixed or has a signed, time-boxed exception."},"roleDetails":{"sales":{"customerProblem":"OpenShift AI 3.4 customers face a CISA known-exploited Brotli decoder flaw that is fixed in some 3.4.6 images, while one GPU serving image is still listed as Affected.","stakeholders":["Agency or campus CISO","AI platform owner","Research computing director","IT vendor management"],"discoveryQuestions":["Which OpenShift AI version and image digests are deployed?","Do model or TrustyAI endpoints accept untrusted HTTP traffic?","Do you use the MLServer CUDA serving runtime?","Do you follow CISA KEV dates for patching priority?"],"valueHypothesis":"Interpretation: a focused review can confirm exposure and apply interim ingress controls before the Nov. 10 KEV date, reducing audit and breach risk. It does not guarantee elimination of the risk.","potentialEngagement":"One- to two-day OpenShift AI image exposure review and 3.4.6 upgrade plan with a written exception record.","unsupportedClaims":["That OpenShift AI is fully remediated","That attackers have exploited AI platforms through this flaw","Any quantified risk or cost reduction"]},"engineering":{"fit":"Any OpenShift AI 3.4 deployment using TrustyAI or MLServer runtimes, especially clusters exposed to untrusted HTTP input.","architectureIntegration":"Upgrade through the OpenShift AI operator to the 3.4.6 images. Put interim br stripping or rejection at OpenShift routes, the ingress or an API gateway.","prerequisites":["Image digest inventory","Access to Red Hat errata and security data","Change window for an operator upgrade"],"constraints":["odh-mlserver-cuda still listed Affected","Air-gapped clusters need mirrored images","Release-note documentation pending update"],"security":"Red Hat CVSS 3.1 8.1 (AV:N/AC:H); Red Hat rates it Important; the flaw is on CISA's KEV list. Possible impacts are memory disclosure, denial of service or code execution when decoding untrusted Brotli data.","proofOfValue":["Digests match RHSA-2026:93550 and RHSA-2026:92510","Ingress rejects Content-Encoding: br test requests","Re-check Red Hat package state for the CUDA image"]},"delivery":{"work":"Inventory clusters, upgrade to the full 3.4.6 image set, apply interim ingress controls and record exceptions.","dependencies":["Red Hat fix for the odh-mlserver-cuda image","Mirrored registry for disconnected sites","Security office approval"],"ownership":"AI platform team; the security office owns risk exceptions.","skillsAdoption":"Platform engineers need a runbook that maps errata to image digests and covers route-level header filtering.","governanceCheckpoints":["Exposure assessment before the KEV date","Signed exception for each Affected image","Post-upgrade verification"],"acceptanceCriteria":["Proposed: 100% of OpenShift AI images at 3.4.6 digests or under a time-boxed exception by Nov. 10","Proposed: zero br-encoded requests accepted from untrusted clients","Proposed: weekly re-check of Red Hat package states until all images are fixed"],"risks":["Fix states change without notice","Header filtering breaks legitimate clients","Unknown clusters missing from the inventory"]}},"retrievedAt":"2026-11-03T04:08:47Z","enrichedAt":"2026-11-03T04:11:01Z","enrichmentBasis":"retrieved source","accessibilityWorkforceImplications":"Requires platform staff who can map deployed OpenShift AI images to errata and roll operator upgrades. Small IT shops may need partner help.","procurementImplications":"Support contracts for self-hosted AI platforms should set patch timelines for known-exploited flaws in bundled components and reporting on images that remain unfixed.","operatingModelImplications":"Self-hosted AI platforms inherit general-purpose library risk. Vulnerability management must cover AI operator images, not only RHEL hosts.","sourceVerification":{"openedUrl":"https://access.redhat.com/errata/RHSA-2026:93550","referenceExcerpt":"Updated images are now available for Red Hat OpenShift AI.","promptVersion":"sled-research-v4.0","model":null,"basis":"agent-reported inspection"}}}]}