Red Hat ships a second OpenShift AI 3.4.6 fix for the KEV-listed Brotli flaw, but one model-serving image remains Affected

Red Hat Product Security · AI platform software used by public and private sectors (Red Hat OpenShift AI) · Global product advisory; applies to any US SLED deployment of OpenShift AI 3.4

Red Hat

Publisher: Red Hat Customer Portal (errata)
Original publication: RHSA-2026:93550 issued Nov. 2, 2026; CVE public Oct. 22, 2026; CISA KEV listing Oct. 27, 2026
Source retrieved: 2026-11-03
Event date: 2026-11-02

Read original source

What happened

Vendor record: on Nov. 2, 2026 Red Hat issued RHSA-2026:93550 (Important) with updated OpenShift AI 3.4.6 TrustyAI service images fixing CVE-2026-111497, an out-of-bounds write in the Google Brotli decoder (Red Hat CVSS 8.1). It follows RHSA-2026:92510 (Oct. 29) for the MLServer image. Red Hat's security data, checked the same night, still lists the odh-mlserver-cuda image as Affected. Independent evidence: CISA added the flaw to its Known Exploited Vulnerabilities catalog on Oct. 27 with a Nov. 10 federal due date. Interpretation: OpenShift AI 3.4 customers need the full 3.4.6 image set, plus a check of GPU serving images.

Why it matters

State agencies, universities and research computing centers running OpenShift AI 3.4 on premises process untrusted HTTP traffic and data, so a known-exploited decoder flaw in AI platform images is an immediate patching item. KEV deadlines bind only federal civilian agencies, but many states and campuses use KEV to set patching priority.

Evidence and measured results

Read RHSA-2026:93550 and RHSA-2026:92510, the Red Hat security data JSON for CVE-2026-111497 (affected releases and package states), Red Hat bulletin RHSB-2026-015 and the CISA KEV JSON feed entry.

Limitations and uncertainty

Vendor self-assessment; fix states observed once (Nov. 2 to 3 UTC) and may change. CISA KEV does not say exploitation has targeted AI platforms. Red Hat release-note docs were still pending update. Severity labels differ by source: the Oct. 29 advisory is labeled Critical, while the Nov. 2 advisory and the CVE are Important.

Put this evidence to work

Lighthouse Advisory interpretation, grounded in this source. Enriched 2026-11-03; this does not change the original publication date. Each role follows the same checklist so takeaways compare across sources.

Sales

Role takeaway

Customer problem: OpenShift AI 3.4 customers face a CISA known-exploited Brotli decoder flaw that is fixed in some 3.4.6 images, while one GPU serving image is still listed as Affected.
Stakeholders: Agency or campus CISO
AI platform owner
Research computing director
IT vendor management
Discovery questions: Which OpenShift AI version and image digests are deployed?
Do model or TrustyAI endpoints accept untrusted HTTP traffic?
Do you use the MLServer CUDA serving runtime?
Do you follow CISA KEV dates for patching priority?
Value hypothesis: Interpretation: a focused review can confirm exposure and apply interim ingress controls before the Nov. 10 KEV date, reducing audit and breach risk. It does not guarantee elimination of the risk.
Potential engagement: One- to two-day OpenShift AI image exposure review and 3.4.6 upgrade plan with a written exception record.
Unsupported claims: That OpenShift AI is fully remediated
That attackers have exploited AI platforms through this flaw
Any quantified risk or cost reduction

Pre-sales engineering

Role takeaway

Fit: Any OpenShift AI 3.4 deployment using TrustyAI or MLServer runtimes, especially clusters exposed to untrusted HTTP input.
Architecture and integration: Upgrade through the OpenShift AI operator to the 3.4.6 images. Put interim br stripping or rejection at OpenShift routes, the ingress or an API gateway.
Prerequisites: Image digest inventory
Access to Red Hat errata and security data
Change window for an operator upgrade
Constraints: odh-mlserver-cuda still listed Affected
Air-gapped clusters need mirrored images
Release-note documentation pending update
Security: Red Hat CVSS 3.1 8.1 (AV:N/AC:H); Red Hat rates it Important; the flaw is on CISA's KEV list. Possible impacts are memory disclosure, denial of service or code execution when decoding untrusted Brotli data.
Proof of value: Digests match RHSA-2026:93550 and RHSA-2026:92510
Ingress rejects Content-Encoding: br test requests
Re-check Red Hat package state for the CUDA image

Delivery

Role takeaway

Work: Inventory clusters, upgrade to the full 3.4.6 image set, apply interim ingress controls and record exceptions.
Dependencies: Red Hat fix for the odh-mlserver-cuda image
Mirrored registry for disconnected sites
Security office approval
Ownership: AI platform team; the security office owns risk exceptions.
Skills and adoption: Platform engineers need a runbook that maps errata to image digests and covers route-level header filtering.
Governance checkpoints: Exposure assessment before the KEV date
Signed exception for each Affected image
Post-upgrade verification
Acceptance criteria: Proposed: 100% of OpenShift AI images at 3.4.6 digests or under a time-boxed exception by Nov. 10
Proposed: zero br-encoded requests accepted from untrusted clients
Proposed: weekly re-check of Red Hat package states until all images are fixed
Risks: Fix states change without notice
Header filtering breaks legitimate clients
Unknown clusters missing from the inventory

Implementation considerations

Lighthouse Advisory interpretation across the operating dimensions a public-sector buyer must settle before this evidence becomes a design. Each note answers the question under its heading for this specific source.

Architecture and integration

What must connect, and where does the AI sit in the workflow?

Exposure depends on whether a component decompresses attacker-controlled Brotli data, for example HTTP Content-Encoding: br at ingress or Node.js decoders. Reverse proxies and gateways in front of model-serving and TrustyAI endpoints can strip or reject br until images are updated.

Governance

Who approves, reviews and stays accountable for outcomes?

KEV listing plus a vendor fix creates an auditable deadline. Images still marked Affected need a documented risk exception with compensating controls.

Security and privacy

What data, permissions and controls need testing?

Red Hat says a successful exploit could disclose memory, crash the service or possibly run code. In AI serving containers, that could expose prompts, documents or model artifacts. Red Hat notes high attack complexity and that hardening reduces but does not eliminate the risk.

Accessibility and workforce

Who is affected, and what skills or accommodations follow?

Requires platform staff who can map deployed OpenShift AI images to errata and roll operator upgrades. Small IT shops may need partner help.

Procurement

What should contracts, pricing and exit terms secure?

Support contracts for self-hosted AI platforms should set patch timelines for known-exploited flaws in bundled components and reporting on images that remain unfixed.

Operating model

Which teams own the service once it runs?

Self-hosted AI platforms inherit general-purpose library risk. Vulnerability management must cover AI operator images, not only RHEL hosts.

Publication history

2026-11-02Red Hat · Issue 042 resources

Read preserved resource versions (JSON)

Stable resource ID: redhat-rhsa-2026-93550-openshift-ai-brotli-kev-fix-20261102