Red Hat AI Base Images 3.4.2 Address Eight Flaws
Tech GuruQuick Answer
Red Hat AI Base Images 3.4.2 addresses eight dependency vulnerabilities across CPU and accelerator variants. Select the variant and architecture used by the workload, then rebuild and redeploy any derived images that still contain the older base.
Confirm Scope And Apply The Supported Fix
What to do now: Record the current base digest, accelerator stack and architecture; select the corresponding 3.4.2 advisory image and rebuild affected workload images through the approved pipeline.
Source check: 2026-10-02 UTC. This notice reflects the primary-source evidence described below, not a completed update or exploitation test. Recheck the advisory and supported distribution channel before changing production.
Scope And Authority
| Product scope | Red Hat OpenShift AI 3.4 CPU, CUDA, ROCm, Gaudi, Spyre, and TPU base images |
|---|---|
| Advisory | RHSA-2026:69927 / RHSA-2026:69929 / RHSA-2026:69930 / RHSA-2026:69931 / RHSA-2026:69932 / RHSA-2026:69933 / RHSA-2026:69934 / RHSA-2026:69935 |
| CVEs | CVE-2026-32283, CVE-2026-48586, CVE-2026-55969, CVE-2026-56208, CVE-2026-56209, CVE-2026-56210, CVE-2026-56211, CVE-2026-64835 |
| Authoritative release date | RHSA-2026:69927: 2026-09-22T08:35:16+00:00 (CSAF initial release) RHSA-2026:69929: 2026-09-22T08:40:06+00:00 (CSAF initial release) RHSA-2026:69930: 2026-09-22T08:42:26+00:00 (CSAF initial release) RHSA-2026:69931: 2026-09-22T08:42:28+00:00 (CSAF initial release) RHSA-2026:69932: 2026-09-22T08:43:00+00:00 (CSAF initial release) RHSA-2026:69933: 2026-09-22T08:43:01+00:00 (CSAF initial release) RHSA-2026:69934: 2026-09-22T08:43:32+00:00 (CSAF initial release) RHSA-2026:69935: 2026-09-22T08:44:38+00:00 (CSAF initial release) |
| Authority revision date | RHSA-2026:69927: 2026-09-22T08:35:21+00:00 (CSAF revision history) RHSA-2026:69929: 2026-09-22T08:40:10+00:00 (CSAF revision history) RHSA-2026:69930: 2026-09-22T08:42:30+00:00 (CSAF revision history) RHSA-2026:69931: 2026-09-22T08:42:33+00:00 (CSAF revision history) RHSA-2026:69932: 2026-09-22T08:43:04+00:00 (CSAF revision history) RHSA-2026:69933: 2026-09-22T08:43:05+00:00 (CSAF revision history) RHSA-2026:69934: 2026-09-22T08:43:37+00:00 (CSAF revision history) RHSA-2026:69935: 2026-09-22T08:44:40+00:00 (CSAF revision history). CSAF generation timestamps are not advisory revision dates. |
| Affected versions | The exact entitled Red Hat OpenShift AI 3.4 CPU, CUDA, ROCm, Gaudi, Spyre, and TPU base images builds before the branch-specific package, image, or digest listed by Red Hat. |
| Fixed version | Red Hat AI Base Images 3.4.2, with architecture-specific fixed digests:TPU: RHSA-2026:69927. CPU: :69929. Gaudi: :69930. Spyre: :69931. ROCm 7.1: :69932. CUDA 12.9: :69933. CUDA 13.0: :69934. ROCm 6.4: :69935. Match the full registry image and digest in the applicable advisory; do not interchange accelerator variants or assume a mutable tag proves deployment. |
| CVSS base score | 7.1 / 7.5 / 7.6 / 8.8 (CVSS v3.1) |
| CVSS severity | High |
| Exploitation status | The eight AI image advisories does not state that these flaws are being exploited. That is not confirmation that exploitation has not occurred. |
What Changed
The update covers Go TLS and Apache Thrift denial-of-service issues plus libaom and FFmpeg media-processing flaws. The presence of these libraries does not prove that every model-serving endpoint exposes the vulnerable path. Inventory media ingestion and network-processing use while applying the correct base-image update.
What To Validate Now
- Inventory. Locate Red Hat OpenShift AI 3.4 CPU, CUDA, ROCm, Gaudi, Spyre, and TPU base images deployments, versions, enabled features, exposure paths, owners, and dependent services.
- Establish applicability. Compare each deployment with the authority's affected-version statement: The exact entitled Red Hat OpenShift AI 3.4 CPU, CUDA, ROCm, Gaudi, Spyre, and TPU base images builds before the branch-specific package, image, or digest listed by Red Hat. Do not infer applicability from product family or severity alone.
- Remediate. Use the matching 3.4.2 fixed base image, rebuild derived artifacts and roll out the newly built digest. Merely pulling a base image does not alter already-running containers or images built from an older layer.
- Validate. Record new base and derived-image digests and verify the image identities running in jobs or pods. Test accelerator initialization, representative inference/training and any media preprocessing used by the workload.
- Retain evidence. Preserve asset and owner identifiers, the applicability decision, before-and-after versions, change approval, installation output, validation results, and any exception or rollback record.
Operational Cautions
Use the exact supported release stream and repository. Test dependencies, clusters, integrations, and rollback before broad deployment; a CVSS rating or reachable feature is not evidence of exploitation.
Evidence To Retain
- Exact product, release stream, package or application version, enabled feature, environment, and accountable owner.
- UTC timestamps, authority revision, approved change record, installer or package-manager output, and resulting version.
- Relevant logs and monitoring evidence, test results, exceptions, compensating controls, and rollback decisions.
Related TechGeeks Resources
Authoritative References
- RHSA-2026:69927
- RHSA-2026:69929
- RHSA-2026:69930
- RHSA-2026:69931
- RHSA-2026:69932
- RHSA-2026:69933
- RHSA-2026:69934
- RHSA-2026:69935
Correction policy: If the authority changes affected versions, fixed versions, severity, exploitation information, mitigations, or required action, TechGeeks will update this notice and its verification date.
