Introduction
A low-privileged data scientist can become a cluster administrator in Red Hat OpenShift AI Service, which gives them full control over all workloads and data. This privilege escalation flaw (CVE-2025-10725, CVSS 9.9) lets an attacker compromise the confidentiality, integrity, and availability of the entire AI platform and the applications it hosts.
About Red Hat OpenShift AI: Red Hat OpenShift AI is an enterprise-grade platform for building, deploying, and managing AI and machine learning workloads at scale. It runs on Kubernetes and includes tools such as Jupyter notebooks for data scientists. Red Hat is a leading vendor of enterprise Linux and container orchestration software, and organizations around the world use OpenShift AI for critical AI/ML operations.
Technical Information
CVE-2025-10725 is an incorrect privilege assignment (CWE-266) in the RBAC (role-based access control) implementation of Red Hat OpenShift AI Service. An authenticated user with low privileges, such as a data scientist working in a standard Jupyter notebook, can use it to escalate to full cluster administrator.
The attack starts in the Jupyter notebook environment, which gives interactive access to the underlying Kubernetes cluster. Misconfigured or overly permissive RBAC rules, service account tokens, or role bindings let the user exploit the flaw and gain cluster-admin rights. With those rights, an attacker can:
- Access all cluster resources and secrets
- Modify or delete workloads
- Exfiltrate sensitive data
- Disrupt services and infrastructure
No public code snippets or proof-of-concept exploitation details are available. The root cause is that the OpenShift AI platform does not enforce strict privilege boundaries between user roles, specifically in how it implements RBAC for notebook and service account access.
Affected Systems and Versions
- Product: Red Hat OpenShift AI Service
- Specific affected versions: Not disclosed in public advisories as of 2025-09-30
- Vulnerable configurations: Any deployment where data scientists or other low-privileged users have access to Jupyter notebook environments and default RBAC settings
Vendor Security History
Red Hat has fixed privilege escalation vulnerabilities in OpenShift before. The best-known case is CVE-2018-1002105, where API server flaws let users gain cluster-admin privileges. Red Hat has a reputation for coordinated security advisories, timely patches, and a mature vulnerability disclosure process. Because OpenShift AI is open source, it is more transparent, but its complex integrations are also more exposed to potential misconfiguration.
