High · CVSS 8.8CVE-2026-13717

Rhoai maas: llm-d: maas/llm-d inference gateway: default allowedroutes.namespaces.from: all allows namespace users to hijack shared model-serving traffic (tokens, prompts, outputs)CVE-2026-13717

Answer in brief

CVE-2026-13717 records a High severity (CVSS 8.8) vulnerability in Rhoai maas: llm-d: maas/llm-d inference gateway: default allowedroutes.namespaces.from: all allows namespace users to hijack shared model-serving traffic (tokens, prompts, outputs). The current sources do not mark it as known exploited. The current feed maps llm-d (generic), Red Hat/rhoai/odh-kserve-controller-rhel9 (generic), Red Hat/rhoai/odh-kserve-llmisvc-controller-rhel9 (generic), Red Hat/rhoai/odh-mod-arch-maas-rhel9 (generic) and additional mapped packages. Check affected ranges and fixed versions before updating.

Analysis pending evidence review

HOL Guard separates source facts from reviewed analysis. See the methodology.

Published Aug 10, 2026Updated Oct 29, 2026Source checked Nov 9, 2026First seen by HOL Aug 10, 2026Material review Oct 29, 2026

Upstream Advisory

Affected scope and exposure questions

The current feed maps llm-d (generic), Red Hat/rhoai/odh-kserve-controller-rhel9 (generic), Red Hat/rhoai/odh-kserve-llmisvc-controller-rhel9 (generic), Red Hat/rhoai/odh-mod-arch-maas-rhel9 (generic) and additional mapped packages. Check affected ranges and fixed versions before updating.

Mapped affected packages and fixed versions
Package	Affected range	Fixed version
llm-dgeneric	>=0 <*	*
Red Hat/rhoai/odh-kserve-controller-rhel9generic	*	Not reported
Red Hat/rhoai/odh-kserve-llmisvc-controller-rhel9generic	*	Not reported
Red Hat/rhoai/odh-mod-arch-maas-rhel9generic	*	Not reported
Red Hat/rhoai/odh-model-controller-rhel9generic	*	Not reported

Recommended response

Check inventory. Check lockfiles and deployed manifests for llm-d, Red Hat/rhoai/odh-kserve-controller-rhel9, Red Hat/rhoai/odh-kserve-llmisvc-controller-rhel9.

Review the reported fix. Source-reported workaround: You can restrict Gateway access to some namespaces only. However, it does not prevent someone from an authorized namespace to hijack the traffic of another. Fully locking down access to the MaaS Gateway is a solution, however it defeats the self-service approach of the component.

Sources and claim methodology

Upstream source description

A flaw was found in the Red Hat OpenShift AI (RHOAI) MaaS Gateway. Improper configuration of the Gateway in a model-serving context allows a standard user with low privileges to intercept, read, log, and alter all MaaS model traffic. This includes sensitive information such as access keys, input prompts, and outputs, leading to significant information disclosure and data tampering.

Quoted source text, attributed separately from HOL analysis.

Rhoai maas: llm-d: maas/llm-d inference gateway: default allowedroutes.namespaces.from: all allows namespace users to hijack shared model-serving traffic (tokens, prompts, outputs)CVE-2026-13717

Rhoai maas: llm-d: maas/llm-d inference gateway: default allowedroutes.namespaces.from: all allows namespace users to hijack shared model-serving traffic (tokens, prompts, outputs)CVE-2026-13717

Key facts

Why this deserves its current priority

Affected scope and exposure questions

Recommended response

Evidence timeline and material changes

Sources and claim methodology

Rhoai maas: llm-d: maas/llm-d inference gateway: default allowedroutes.namespaces.from: all allows namespace users to hijack shared model-serving traffic (tokens, prompts, outputs)CVE-2026-13717

Rhoai maas: llm-d: maas/llm-d inference gateway: default allowedroutes.namespaces.from: all allows namespace users to hijack shared model-serving traffic (tokens, prompts, outputs)CVE-2026-13717

Key facts

Why this deserves its current priority

Affected scope and exposure questions

Recommended response

Evidence timeline and material changes

Sources and claim methodology

Related CVEs