{"id":144093,"date":"2025-10-04T05:11:54","date_gmt":"2025-10-04T03:11:54","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/uyazvimost-v-red-hat-openshift-ai-dopuskayushhaya-root-dostup-k-uzlam-klastera"},"modified":"2025-10-04T05:11:54","modified_gmt":"2025-10-04T03:11:54","slug":"uyazvimost-v-red-hat-openshift-ai-dopuskayushhaya-root-dostup-k-uzlam-klastera","status":"publish","type":"post","link":"https:\/\/prohoster.info\/sq\/blog\/news\/uyazvimost-v-red-hat-openshift-ai-dopuskayushhaya-root-dostup-k-uzlam-klastera","title":{"rendered":"Nj\u00eb vulnerabilitet n\u00eb Red Hat OpenShift AI, i cili lejon akses root n\u00eb nyjat e klasterit.","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

N\u00eb platform\u00ebn OpenShift AI Service, e cila lejon organizimin e pun\u00ebs s\u00eb klasterit p\u00ebr ekzekutimin dhe trajnimet e modeleve AI, \u00ebsht\u00eb zbuluar nj\u00eb vulnerabilitet (CVE-2025-10725), i cili i lejon nj\u00eb p\u00ebrdoruesi pa privilegje t\u00eb fitoj\u00eb t\u00eb drejtat e administratorit t\u00eb klasterit. Pas nj\u00eb sulmi t\u00eb suksessh\u00ebm, sulmuesi fiton mund\u00ebsin\u00eb p\u00ebr t\u00eb menaxhuar klasterin, akses t\u00eb plot\u00eb n\u00eb t\u00eb gjitha sh\u00ebrbimet, t\u00eb dh\u00ebnat dhe aplikacionet q\u00eb ekzekutohen n\u00eb klaster, si dhe akses root n\u00eb nyjet e klasterit. <\/p>\n

P\u00ebr t\u00eb kryer nj\u00eb sulm, mjafton \u00e7do qasje t\u00eb autentifikimit q\u00eb nuk ka privilegje n\u00eb platform\u00eb, p\u00ebr shembull, nj\u00eb hulumtues i lidhur me OpenShift AI q\u00eb p\u00ebrdor Jupyter notebook mund t\u00eb kryej\u00eb sulmin. Problemi i \u00ebsht\u00eb caktuar nj\u00eb nivel kritik rreziku \u2014 9.9 nga 10. <\/p>\n

Dob\u00ebsia t\u00ebrhiqet nga caktimi i gabuar i rolit \u00abkueue-batch-user-role\u00bb, i cili p\u00ebr gabim u lidh me grupin \u00absystem:authenticated\u00bb, duke lejuar \u00e7do p\u00ebrdorues t\u00eb sh\u00ebrbimit t\u00eb krijoj\u00eb nj\u00eb pun\u00eb (OpenShift Job) n\u00eb \u00e7do hap\u00ebsir\u00eb em\u00ebrtimi. P\u00ebrve\u00e7 k\u00ebsaj, \u00e7do p\u00ebrdorues mund t\u00eb krijoj\u00eb nj\u00eb pun\u00eb n\u00eb hap\u00ebsir\u00ebn e privilegjuar t\u00eb em\u00ebrtimit \u00abopenshift-apiserver-operator\u00bb dhe ta konfiguroj\u00eb at\u00eb p\u00ebr t'u ekzekutuar me privilegjet e ServiceAccount. <\/p>\n

N\u00eb ambientin p\u00ebr ekzekutimin e kodit me privilegjet e ServiceAccount, \u00ebsht\u00eb e disponueshme nj\u00eb token akses me t\u00eb drejtat e ServiceAccount, e cila sulmuesi mund ta nxjerr\u00eb dhe ta p\u00ebrdor\u00eb p\u00ebr t\u00eb komprometuar llogarit\u00eb m\u00eb me privilegje. N\u00eb fund, sulmi mund t\u00eb p\u00ebrfundoj\u00eb me marrjen e aksesit root n\u00eb master-nj\u00ebsit, duke i dh\u00ebn\u00eb k\u00ebshtu sulmuesit mund\u00ebsin\u00eb p\u00ebr t\u00eb menaxhuar plot\u00ebsisht t\u00eb gjith\u00eb p\u00ebrmbajtjen e klasterit.
\n
Burimi: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0412 \u043f\u043b\u0430\u0442\u0444\u043e\u0440\u043c\u0435 OpenShift AI Service, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0435\u0439 \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u043e\u0432\u0430\u0442\u044c \u0440\u0430\u0431\u043e\u0442\u0443 \u043a\u043b\u0430\u0441\u0442\u0435\u0440\u0430 \u0434\u043b\u044f \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044f \u0438 \u043e\u0431\u0443\u0447\u0435\u043d\u0438\u044f AI-\u043c\u043e\u0434\u0435\u043b\u0435\u0439, \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0430 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c (CVE-2025-10725), \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u043d\u0435\u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u043e\u043c\u0443 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044e \u043f\u043e\u043b\u0443\u0447\u0438\u0442\u044c \u043f\u0440\u0430\u0432\u0430 \u0430\u0434\u043c\u0438\u043d\u0438\u0441\u0442\u0440\u0430\u0442\u043e\u0440\u0430 \u043a\u043b\u0430\u0441\u0442\u0435\u0440\u0430. \u041f\u043e\u0441\u043b\u0435 \u0443\u0441\u043f\u0435\u0448\u043d\u043e\u0439 \u0430\u0442\u0430\u043a\u0438 \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a \u043f\u043e\u043b\u0443\u0447\u0430\u0435\u0442 \u0432\u043e\u0437\u043c\u043e\u0436\u043d\u043e\u0441\u0442\u044c \u0443\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u044f \u043a\u043b\u0430\u0441\u0442\u0435\u0440\u043e\u043c, \u043f\u043e\u043b\u043d\u044b\u0439 \u0434\u043e\u0441\u0442\u0443\u043f \u043a\u043e \u0432\u0441\u0435\u043c \u0441\u0435\u0440\u0432\u0438\u0441\u0430\u043c, \u0434\u0430\u043d\u043d\u044b\u043c \u0438 \u0437\u0430\u043f\u0443\u0441\u043a\u0430\u0435\u043c\u044b\u043c \u0432 \u043a\u043b\u0430\u0441\u0442\u0435\u0440\u0435 \u043f\u0440\u0438\u043b\u043e\u0436\u0435\u043d\u0438\u044f\u043c, \u0430 \u0442\u0430\u043a\u0436\u0435 root-\u0434\u043e\u0441\u0442\u0443\u043f \u043a \u0443\u0437\u043b\u0430\u043c \u043a\u043b\u0430\u0441\u0442\u0435\u0440\u0430. \u0414\u043b\u044f \u043f\u0440\u043e\u0432\u0435\u0434\u0435\u043d\u0438\u044f \u0430\u0442\u0430\u043a\u0438 \u0434\u043e\u0441\u0442\u0430\u0442\u043e\u0447\u043d\u043e \u043b\u044e\u0431\u043e\u0433\u043e \u043d\u0435\u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u043e\u0433\u043e […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-144093","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Vulnerabilitet n\u00eb Red Hat OpenShift AI, q\u00eb lejon akses root n\u00eb nyjet e klasterit | ProHoster","description":"N\u00eb platform\u00ebn OpenShift AI Service, e cila lejon organizimin e pun\u00ebs s\u00eb klasterit p\u00ebr ekzekutimin dhe trajnimet e modeleve AI, \u00ebsht\u00eb zbuluar nj\u00eb vulnerabilitet (CVE-2025-10725), i cili i lejon nj\u00eb p\u00ebrdoruesi pa privilegje t\u00eb fitoj\u00eb t\u00eb drejtat.","canonical_url":"https:\/\/prohoster.info\/sq\/blog\/news\/uyazvimost-v-red-hat-openshift-ai-dopuskayushhaya-root-dostup-k-uzlam-klastera","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"sq_AL","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432 Red Hat OpenShift AI, \u0434\u043e\u043f\u0443\u0441\u043a\u0430\u044e\u0449\u0430\u044f root-\u0434\u043e\u0441\u0442\u0443\u043f \u043a \u0443\u0437\u043b\u0430\u043c \u043a\u043b\u0430\u0441\u0442\u0435\u0440\u0430 | ProHoster","og:description":"\u0412 \u043f\u043b\u0430\u0442\u0444\u043e\u0440\u043c\u0435 OpenShift AI Service, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0435\u0439 \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u043e\u0432\u0430\u0442\u044c \u0440\u0430\u0431\u043e\u0442\u0443 \u043a\u043b\u0430\u0441\u0442\u0435\u0440\u0430 \u0434\u043b\u044f \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044f \u0438 \u043e\u0431\u0443\u0447\u0435\u043d\u0438\u044f AI-\u043c\u043e\u0434\u0435\u043b\u0435\u0439, \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0430 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c (CVE-2025-10725), \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u043d\u0435\u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u043e\u043c\u0443 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044e \u043f\u043e\u043b\u0443\u0447\u0438\u0442\u044c \u043f\u0440\u0430\u0432\u0430.","og:url":"https:\/\/prohoster.info\/sq\/blog\/news\/uyazvimost-v-red-hat-openshift-ai-dopuskayushhaya-root-dostup-k-uzlam-klastera","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2025-10-04T03:11:54+00:00","article:modified_time":"2025-10-04T03:11:54+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"144093","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":"default","schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-01-23 15:07:19","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2026-01-23 15:07:19","updated":"2026-01-23 15:07:19","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/posts\/144093","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/comments?post=144093"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/posts\/144093\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/media?parent=144093"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/categories?post=144093"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/tags?post=144093"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}