{"resourceId":"redhat-vllm-032-advisories-openshift-ai-rhel-ai-inference-server-fix-status-20261026","versions":[{"version":"external-322c076bd7129bbf868cd552be7c6bf1f64f2ff87e4a1e9e5323e43a6e703d25","resource":{"id":"redhat-vllm-032-advisories-openshift-ai-rhel-ai-inference-server-fix-status-20261026","title":"Red Hat triage of the vLLM 0.32.0 security advisories: two Important flaws listed as Affected and five lower-severity flaws as Fix deferred across OpenShift AI, RHEL AI and AI Inference Server","organization":"Red Hat Product Security","sector":"AI model serving platforms used across public and private sectors (Red Hat AI Inference Server 3, RHEL AI 3, Red Hat OpenShift AI)","geography":"Global product advisory; applies to any US SLED deployment of these products","publishedAt":"Red Hat CVE records made public Oct. 26, 2026; upstream GitHub advisories published Oct. 28, 2026; fix status observed Oct. 31, 2026","publicationDate":"2026-10-26","eventDate":"2026-10-28","sourceName":"Red Hat Customer Portal (CVE database)","sourceLabel":"CVE-2026-115915 (vLLM arbitrary code execution via unrestricted image format parsing)","sourceUrl":"https://access.redhat.com/security/cve/cve-2026-115915","evidenceClass":"vendor-claim","outcomeClass":"cautionary","topics":["infrastructure","data-security","developers-agents"],"finding":"Vendor record: Red Hat's security data, checked Oct. 31, 2026, covers seven of the eight vLLM advisories fixed upstream in vLLM 0.32.0 (CVE-2026-115911 to -115918; Red Hat's data API returned no record for CVE-2026-115913). Two are rated Important: CVE-2026-115915 (CVSS 8.1, draft; image bytes reach Pillow without a format allowlist, so an EPS payload can reach a vulnerable Ghostscript) and CVE-2026-115912 (CVSS 7.5; forged shared-memory handles reach pickle.loads in scale-out multimodal caching). Both are listed as Affected, with no fix yet, for AI Inference Server 3, RHEL AI 3 and most OpenShift AI serving images; two AI Inference Server images (rhaii/vllm-neuron-rhel9 and rhaii/vllm-tpu-rhel9) are marked Will not fix for CVE-2026-115915. The five Moderate or Low flaws (denial of service via unbounded or untrusted chat templates, crafted OCR images and out-of-bounds prompt token IDs, plus a Low-rated CORS information disclosure) are marked Fix deferred for all three products. Red Hat says text-only models, or endpoints behind authenticated network boundaries, are not exposed to CVE-2026-115915, and recommends NetworkPolicy, removing Ghostscript and rejecting EPS at the gateway.","sledRelevance":"Agencies, universities and research centers that self-host models on OpenShift AI, RHEL AI or AI Inference Server for data-residency reasons own the patch gap themselves. Multimodal workloads such as document intake, permit or claims image processing and research vision models are the exposed configuration. Text-only, gateway-protected deployments carry much less exposure according to Red Hat. This is a status signal for security and platform teams, not evidence of exploitation.","evidence":"Read the CVE-2026-115915 and CVE-2026-115912 pages and pulled Red Hat's security data records for all eight CVE numbers (public dates, severity, package fix states, statements, mitigations). Cross-checked against AI Security Wire's Oct. 29 analysis, which reports that GitHub published the eight advisories Oct. 28, that NVD's own scores are higher for CVE-2026-115912 (8.8) and CVE-2026-115915 (9.8), and that none appeared in the CISA KEV feed as of Oct. 29. Fix states are a point-in-time observation and may change at any time.","architectureImplications":"Exposure depends on configuration: multimodal image input, shared-memory multimodal caching in scale-out serving, and whether inference endpoints sit behind an authenticating gateway. Teams should inventory which serving runtimes and images (KServe, llm-d KV cache, vLLM CUDA/ROCm images) are deployed and which accept image input.","governanceImplications":"A Fix deferred status shifts risk acceptance to the customer. Agencies need a documented exception or compensating control for each deferred CVE, plus a check that the vendor's statement matches their real configuration.","securityPrivacyImplications":"Code execution inside a model-serving container could expose prompts, documents and model artifacts processed by that replica. Upstream analysis notes vLLM does no authentication unless an API key is set, so exposed endpoints are reachable by any client that can connect.","caveats":"Vendor self-assessment; Red Hat CVSS for CVE-2026-115915 is marked draft. Fix states were observed once, on Oct. 31, 2026, and may change. Red Hat had no record for CVE-2026-115913 at retrieval. No exploitation evidence was found in the sources read; the reporters describe lab reproductions. Older than the last run by publication date; included because the downstream fix status, five days after disclosure, is current information not previously covered.","streamIds":["red-hat"],"roles":{"sales":"Sales framing: this is a trust conversation, not a sales hook. Customers running OpenShift AI, RHEL AI or AI Inference Server should hear about the two Important vLLM flaws still listed as Affected, and the five deferred ones, from their account team before an auditor raises them. Offer a configuration review and a clear patch-communication path. Do not claim the platform is protected by default or that Red Hat has fixed these; the record as of Oct. 31 says otherwise.","engineering":"Engineering framing: determine exposure from configuration rather than version alone. Check whether any served model accepts image input, whether Ghostscript is in the serving image or host, whether shared-memory multimodal caching is on in scale-out serving, and whether endpoints are reachable without an authenticating gateway. Apply Red Hat's mitigations (NetworkPolicy to trusted gateways, remove Ghostscript, reject EPS) where fixes are not available, and verify them with negative tests.","delivery":"Delivery framing: treat this as a short remediation sprint with a tracking item per CVE. Record each deployed serving image, its Red Hat fix state and the compensating control applied. Get the security officer to sign off risk acceptance for each Fix deferred item. Re-check Red Hat's records weekly and schedule the image update when a fixed build ships. Close the work only when negative tests show unauthenticated or EPS requests are rejected."},"roleDetails":{"sales":{"customerProblem":"Agencies and campuses self-hosting models on Red Hat AI products face two Important vLLM flaws with no downstream fix yet and five deferred fixes.","stakeholders":["Agency or campus CISO","AI platform owner","Research computing director","Vendor management / contracts office"],"discoveryQuestions":["Which of your served models accept image or document input?","Are inference endpoints reachable only through an authenticating gateway?","Do you run scale-out serving with shared-memory multimodal caching?","How do you record risk acceptance for vendor Fix deferred items?"],"valueHypothesis":"A focused configuration review can show whether a deployment is exposed and apply documented mitigations until fixed images ship (interpretation).","potentialEngagement":"Two- to three-day exposure review and mitigation of existing Red Hat AI serving deployments, with a written CVE-by-CVE status record.","unsupportedClaims":["That Red Hat AI products are already patched for these CVEs","That any deployment has been exploited","That text-only deployments are free of all eight flaws"]},"engineering":{"fit":"Applies to any deployment of AI Inference Server 3, RHEL AI 3 or OpenShift AI model serving that bundles vLLM below 0.32.0.","architectureIntegration":"Mitigations sit at the network and gateway layer (NetworkPolicy, authenticating gateway, content-type filtering) and in the image build (removing Ghostscript).","prerequisites":["Inventory of serving runtimes and image tags","Knowledge of which models are multimodal","Access to build or rebuild serving images"],"constraints":["Downstream fixes not yet available for the Important CVEs as of Oct. 31, 2026","Image rebuilds and network changes require pod restarts","CVE-2026-115913 had no Red Hat record at retrieval"],"security":"Red Hat scores CVE-2026-115915 at 8.1 (draft) and CVE-2026-115912 at 7.5; NVD's primary scores are higher (9.8 and 8.8) according to AI Security Wire.","proofOfValue":["Send a request without credentials to each endpoint and confirm the gateway rejects it","Submit an EPS-labelled image in a test namespace and confirm it is rejected before vLLM","Confirm Ghostscript is absent from serving images"]},"delivery":{"work":"Inventory deployed Red Hat AI serving images, map each to Red Hat fix states, apply compensating controls and track fixed builds.","dependencies":["Red Hat fixed images","Gateway or service-mesh configuration","Security office approval for risk acceptance"],"ownership":"AI platform team, with the agency or campus security office owning risk acceptance.","skillsAdoption":"Platform engineers need to read Red Hat package-level fix states and maintain NetworkPolicy; a short runbook helps.","governanceCheckpoints":["Documented exception for each Fix deferred CVE","Security sign-off on compensating controls","Weekly re-check of Red Hat records until fixed"],"acceptanceCriteria":["Proposed: 100% of serving endpoints reject unauthenticated requests in negative tests","Proposed: fixed images deployed within an agreed number of days of Red Hat release","Proposed: no serving image contains Ghostscript"],"risks":["Fix states change without notice","Mitigations break legitimate image formats","Shadow deployments missing from the inventory"]}},"retrievedAt":"2026-11-01T03:09:13Z","enrichedAt":"2026-11-01T03:14:07Z","enrichmentBasis":"retrieved source","accessibilityWorkforceImplications":"Requires platform engineers who can read package-level fix states, build or patch container images and write Kubernetes NetworkPolicy. Smaller SLED IT shops may need partner or Red Hat support to do this quickly.","procurementImplications":"Support agreements for self-hosted AI platforms should state patch timelines for Important flaws in bundled open source engines, and how deferred fixes are communicated. The gap between upstream fix (vLLM 0.32.0) and downstream product fix is a contract question.","operatingModelImplications":"Self-hosting AI moves vulnerability management for the inference engine to the agency or campus. That needs a standing process to track upstream vLLM releases against the downstream product cadence.","sourceVerification":{"openedUrl":"https://access.redhat.com/security/cve/cve-2026-115915","referenceExcerpt":"Deployments serving strictly text-based language models or those isolated behind authenticated network boundaries are not exposed to this flaw.","promptVersion":"sled-research-v4.0","model":null,"basis":"agent-reported inspection"}}}]}