Red Hat ships 18 OpenShift AI base-image advisories carrying the KEV-listed Brotli fix, but the CUDA MLServer image is still Affected

Red Hat Product Security · AI platform software used by public and private sectors (Red Hat OpenShift AI) · Global product advisory; applies to any US SLED deployment of OpenShift AI 3.0, 3.4 or 3.5

Red Hat

Publisher: Red Hat Customer Portal (errata)
Original publication: RHSA-2026:94452 to 94469 issued Nov. 3, 2026; CVE public Oct. 22, 2026; CISA KEV listing Oct. 27, 2026
Source retrieved: 2026-11-04
Event date: 2026-11-03

Read original source

What happened

Vendor record: on Nov. 3, 2026 Red Hat issued 18 advisories (RHSA-2026:94452 to 94469) updating Red Hat AI Base Images for OpenShift AI 3.0, 3.4 and 3.5 across CPU, CUDA 12.9/13.0, ROCm, Gaudi, Neuron, Spyre and TPU. Every listed image picks up CVE-2026-111497, the Brotli decoder flaw; the 3.0.8 CPU image is rated Critical and lists 25 CVEs, and the CUDA 13.0 image (also Critical) lists 23. Red Hat's security data, checked the same evening, still shows the odh-mlserver-cuda serving image as Affected. Independent evidence: CISA lists the flaw as known-exploited, federal due date Nov. 10. Interpretation: this widens the Nov. 2 fix from one service image to the base images most custom workbenches and serving runtimes build on.

Why it matters

Universities, research computing centers and state agencies that build custom notebooks or model-serving containers on Red Hat AI base images need to rebuild on the Nov. 3 digests, not just upgrade the OpenShift AI operator. Many states and campuses use the KEV list to set patch priority even though its deadline binds only federal agencies.

Evidence and measured results

Read RHSA-2026:94459 and RHSA-2026:94468, the Red Hat security data JSON for CVE-2026-111497 (18 Nov. 3 affected_release entries and package states) and the CISA KEV feed entry.

Limitations and uncertainty

Vendor self-assessment with terse advisories; the reason for the Critical rating is not stated. Package states were observed once (Nov. 3 evening CT) and may change. KEV does not say exploitation targeted AI platforms.

Put this evidence to work

Lighthouse Advisory interpretation, grounded in this source. Enriched 2026-11-04; this does not change the original publication date. Each role follows the same checklist so takeaways compare across sources.

Sales

Role takeaway

Customer problem: OpenShift AI customers may not realize that base-image advisories require rebuilding their own derived images.
Stakeholders: Agency or campus CISO
Research computing director
AI platform owner
Discovery questions: Which notebooks and serving runtimes are built on Red Hat AI base images?
Are images pinned by digest or floating tags?
Who approves security exceptions for unfixed images?
Value hypothesis: A focused rebuild review can shorten exposure to a known-exploited flaw across AI workloads; the size of that reduction is unmeasured.
Potential engagement: Short (1 to 2 week) base-image inventory and rebuild review tied to the KEV date.
Unsupported claims: The platform is fully patched
The flaw was exploited against AI workloads
Guaranteed risk reduction or cost savings

Pre-sales engineering

Role takeaway

Fit: Relevant to any OpenShift AI 3.0, 3.4 or 3.5 deployment using rhai base images for custom workbenches or serving.
Architecture and integration: Hook base-image digest changes into CI rebuild triggers; enforce digest pinning and admission checks for stale bases.
Prerequisites: Image inventory with base-image lineage
Rebuild pipeline access
Registry access to registry.redhat.io
Constraints: CUDA MLServer image still Affected
Air-gapped sites must mirror new digests
KEV deadline binds only federal civilian agencies
Security: Rebuild on fixed bases; reject or strip br encoding from untrusted clients for still-Affected images; rescan rebuilt images.
Proof of value: Digest comparison of running images against the Nov. 3 advisories
Scanner confirms CVE-2026-111497 absent in rebuilt images
Ingress test rejects Content-Encoding: br

Delivery

Role takeaway

Work: Inventory, rebuild and redeploy AI images on fixed bases; manage exceptions for images without fixes.
Dependencies: CI/CD rebuild pipelines
Change windows for serving endpoints
Security office for exceptions
Ownership: AI platform team, with the security office owning exceptions.
Skills and adoption: Train platform staff to trace image lineage and read Red Hat security data package states.
Governance checkpoints: Inventory sign-off
Exception approval for still-Affected images
Post-rebuild scan review
Acceptance criteria: Proposed: 100% of running AI images on Nov. 3 or later base digests
Proposed: exceptions documented for every still-Affected image
Proposed: ingress br controls verified where exceptions apply
Risks: Floating tags hide stale layers
Rebuilds break pinned Python dependencies
Vendor package states change after review

Implementation considerations

Lighthouse Advisory interpretation across the operating dimensions a public-sector buyer must settle before this evidence becomes a design. Each note answers the question under its heading for this specific source.

Architecture and integration

What must connect, and where does the AI sit in the workflow?

Base images sit under derived images, so fixes reach production only when downstream workbench, pipeline and serving images are rebuilt and redeployed. Image pinning by digest makes this visible; floating tags can hide stale layers.

Governance

Who approves, reviews and stays accountable for outcomes?

A dated KEV deadline plus vendor fixes gives an auditable trigger. The still-Affected CUDA MLServer image needs a documented, time-boxed exception.

Security and privacy

What data, permissions and controls need testing?

Red Hat and CISA describe memory disclosure, denial of service or possible code execution from crafted Brotli streams. In AI containers that could expose prompts, documents or model artifacts. The 25-CVE CPU image also carries other bundled-library fixes not described individually.

Accessibility and workforce

Who is affected, and what skills or accommodations follow?

Needs staff who can trace derived images to base-image digests and run rebuild pipelines. Smaller campus or county teams may need partner help.

Procurement

What should contracts, pricing and exit terms secure?

Support contracts for self-hosted AI platforms should cover base-image rebuild guidance and reporting on images that remain unfixed after a KEV listing.

Operating model

Which teams own the service once it runs?

AI platform security is a supply-chain task: image rebuild cadence matters as much as operator upgrades.

Publication history

2026-11-03Red Hat · Issue 052 resources

Read preserved resource versions (JSON)

Stable resource ID: redhat-ai-base-images-brotli-kev-batch-20261103