CVE-2026-18618 in OpenShift AI
Summary
by MITRE • 08/11/2026
A flaw was found in ml-metadata. The statically-linked gRPC stack in ml-metadata is outdated, making it vulnerable to known HTTP/2 denial of service (DoS) issues. An in-cluster attacker, with network access to the MLMD pod, could exploit these vulnerabilities by sending specially crafted HTTP/2 requests. This could lead to a denial of service by crashing the MLMD pod, disrupting all pipeline runs in the affected namespace.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 08/11/2026
The vulnerability identified in ml-metadata represents a critical security weakness within the machine learning metadata management system that operates within Kubernetes environments. This flaw specifically targets the statically-linked gRPC stack implementation, which serves as the communication backbone for metadata exchange between various components of the ML pipeline. The outdated gRPC stack contains known HTTP/2 denial of service vulnerabilities that have been documented in various security advisories and affect the underlying network protocols used for inter-service communication.
The technical exploitation of this vulnerability occurs through the manipulation of HTTP/2 protocol implementations within the gRPC stack. An attacker positioned within the same cluster and possessing network access to the MLMD pod can craft malicious HTTP/2 requests that trigger specific buffer overflow conditions or resource exhaustion patterns inherent in the older gRPC implementation. These crafted requests leverage weaknesses in the HTTP/2 connection handling mechanisms, particularly around header processing and stream management, which cause the gRPC stack to crash or become unresponsive. The attack vector is particularly concerning because it requires minimal privileges beyond network access and can be executed from within the cluster boundaries.
The operational impact of this vulnerability extends far beyond a simple service disruption, as the MLMD pod serves as a critical metadata repository for all pipeline operations within its namespace. When the pod crashes due to the DoS attack, it results in complete disruption of machine learning workflows including training jobs, model deployment processes, and data lineage tracking. This cascading failure affects not just individual pipeline runs but entire development and production environments that depend on consistent metadata availability. The vulnerability essentially provides an attacker with a mechanism to systematically undermine ML operations and potentially cause significant business disruption.
Organizations should implement immediate mitigation strategies including updating the ml-metadata component to use a newer version of the gRPC stack that addresses these HTTP/2 vulnerabilities. The fix requires upgrading the underlying dependencies and rebuilding the container images to ensure the statically-linked libraries contain patched versions. Network segmentation and access controls should be strengthened to limit potential attack surfaces, while monitoring systems should be enhanced to detect anomalous HTTP/2 traffic patterns that may indicate exploitation attempts. This vulnerability aligns with CWE-400 which categorizes resource exhaustion vulnerabilities, and maps to ATT&CK technique T1499.004 for network denial of service attacks. The remediation process must also include comprehensive testing of updated components to ensure compatibility with existing ML workflows and avoid introducing regressions in functionality.