A vulnerability (CVE-2025-10725) has been identified in the OpenShift AI Service platform, which allows the organization of a cluster for running and training AI models. This vulnerability enables an unprivileged user to gain administrator rights to the cluster. Following a successful attack, the attacker gains control over the cluster, full access to all services, data, and applications running in the cluster, as well as root access to the cluster nodes.
An attack can be conducted with any unprivileged authenticated access to the platform; for instance, a researcher connected to OpenShift AI using a Jupyter notebook could carry out the attack. The issue is assigned a critical severity level of 9.9 out of 10.
The vulnerability is caused by the incorrect assignment of the 'kueue-batch-user-role', which mistakenly became associated with the 'system:authenticated' group, allowing any service user to create a job (OpenShift Job) in any namespace. Among other things, any user could create a job in the privileged namespace 'openshift-apiserver-operator' and configure its execution with ServiceAccount privileges.
In the environment for executing code with ServiceAccount privileges, an access token with ServiceAccount rights is available, which the attacker could extract and use to compromise more privileged accounts. Ultimately, the attack could escalate to gaining root access to master nodes, after which the attacker would have full control over all cluster contents.
Source: opennet.ru
