CVE-2026-13717 Overview
CVE-2026-13717 is an improper access control flaw [CWE-284] in the Red Hat OpenShift AI (RHOAI) Model-as-a-Service (MaaS) Gateway. The Gateway is misconfigured within model-serving deployments, allowing standard low-privileged users to intercept, read, log, and alter MaaS model traffic. Attackers can capture sensitive material including access keys, model input prompts, and generated outputs. The flaw enables both information disclosure and data tampering across all model traffic routed through the affected Gateway. Red Hat has issued advisory RHSA-2026:53262 to address the issue.
Critical Impact
Any authenticated tenant on the cluster can silently proxy and modify model traffic, exposing credentials, prompts, and inference outputs across all MaaS consumers.
Affected Products
- Red Hat OpenShift AI (RHOAI)
- RHOAI MaaS Gateway component in model-serving deployments
- Environments referenced by advisory RHSA-2026:53262
Discovery Timeline
- 2026-08-10 - CVE-2026-13717 published to NVD
- 2026-08-11 - Last updated in NVD database
Technical Details for CVE-2026-13717
Vulnerability Analysis
The RHOAI MaaS Gateway routes inference traffic between clients and hosted model endpoints. Improper configuration of Gateway access controls exposes the traffic plane to any authenticated user of the platform. A standard user with low privileges can attach to or reconfigure Gateway routing to intercept requests destined for other tenants' models. The interception path captures API access keys carried in headers, user prompts submitted for inference, and model responses returned to callers. Because the attacker sits inline, the same position permits active tampering of requests and responses. This undermines both confidentiality and integrity guarantees expected by MaaS consumers, and it violates tenant isolation in a multi-tenant model-serving environment.
Root Cause
The root cause is improper access control [CWE-284] on the MaaS Gateway configuration surface. Low-privileged roles retain the ability to influence Gateway routing and traffic handling that should be restricted to cluster or service administrators. Tenant-level scoping is not enforced on Gateway operations that affect shared model-serving traffic.
Attack Vector
The attack vector is network-based and requires only low privileges with no user interaction. An authenticated tenant on the OpenShift cluster interacts with the MaaS Gateway to insert an interception or logging path. Once positioned, the attacker captures credentials, prompts, and outputs traversing the Gateway and can modify them in transit.
No verified proof-of-concept code is publicly available. See the Red Hat CVE Details and Red Hat Bug Report for vendor technical context.
Detection Methods for CVE-2026-13717
Indicators of Compromise
- Unexpected Gateway route, VirtualService, or HTTPRoute objects created by non-administrative service accounts in RHOAI namespaces.
- MaaS model traffic traversing intermediate pods or sidecars not part of the sanctioned model-serving topology.
- Anomalous egress from tenant workloads containing serialized prompt or response payloads and bearer tokens.
- Audit log entries showing standard users modifying Gateway ConfigMap, Secret, or CRD resources tied to model serving.
Detection Strategies
- Review Kubernetes audit logs for create, update, and patch verbs against Gateway API resources performed by low-privileged identities.
- Compare live Gateway routing configuration against a signed known-good baseline and alert on drift.
- Inspect model-serving traffic flows for TLS termination or re-encryption at unexpected hops inside the mesh.
Monitoring Recommendations
- Forward OpenShift audit logs and service mesh telemetry to a centralized analytics platform for correlation across tenants.
- Alert on any RoleBinding or ClusterRoleBinding change that grants Gateway or route permissions to non-admin subjects.
- Track MaaS access-key usage patterns and alert on reuse from unexpected source pods or namespaces.
How to Mitigate CVE-2026-13717
Immediate Actions Required
- Apply the Red Hat fix documented in RHSA-2026:53262 to all affected RHOAI clusters.
- Rotate MaaS API access keys, service account tokens, and any credentials that transited the Gateway prior to patching.
- Audit RBAC in RHOAI namespaces and remove Gateway configuration rights from standard user roles.
- Review recent Gateway configuration changes and revert unauthorized modifications.
Patch Information
Red Hat has published advisory RHSA-2026:53262 containing the corrected MaaS Gateway configuration and access control enforcement. Administrators should follow the Red Hat Security Errata guidance for the affected RHOAI release channel and apply the update to all model-serving clusters. Verify that post-patch Gateway resources cannot be modified by non-administrative roles.
Workarounds
- Restrict Gateway and route API permissions to cluster administrators using least-privilege RBAC until the patch is applied.
- Isolate MaaS model-serving workloads in dedicated namespaces with NetworkPolicy denying tenant-to-Gateway management traffic.
- Enable strict mTLS in the service mesh and pin acceptable Gateway identities for model-serving routes.
# Configuration example: restrict Gateway modification to admins only
oc create clusterrole maas-gateway-readonly \
--verb=get,list,watch \
--resource=gateways.gateway.networking.k8s.io,httproutes.gateway.networking.k8s.io
oc adm policy add-cluster-role-to-group maas-gateway-readonly system:authenticated
oc adm policy remove-cluster-role-from-group cluster-admin system:authenticated
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
