What happened
Verified on the Red Hat advisory (fetched): CVE-2026-17557 (Red Hat CVSS 6.5, CWE-918) — malicious model URL causes disclosure of the tenant's model authentication secret and enables SSRF; Red Hat states the issue is specific to RHOAI 3.4 and addressed in 3.5.
Why it matters
Managed-AI eval harnesses hold cloud model credentials by design; a secret-exfiltrating SSRF in the model-loading path lets a low-privileged tenant user steal the platform's model-auth material and probe internal cluster services.
Attack vector
An authenticated user submits an EvalHub evaluation job with a malicious model.url in the JobSpec; the harness fetches the URL together with the tenant's model-auth secret, sending the secret to an external listener, and the fetch also functions as SSRF from the eval pod's network position.
Affected systems
Red Hat OpenShift AI 3.4 lm-evaluation-harness component (EvalHub jobs); addressed in RHOAI 3.5 by architectural change
Mitigation
Upgrade to RHOAI 3.5; restrict which model URLs evaluation jobs may reference; monitor outbound requests from eval pods.