Red Hat Instructlab vulnerabilities

2 CVEs affecting Red Hat Instructlab, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2026-6859, published 2026-04-22.

More from Red Hat.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

• CVE-2026-6859, published 2026-04-22. High severity, CVSS 8.8. EPSS: 0.8% chance of exploitation in the next 30 days. A flaw was found in InstructLab. The `linux_train.py` script hardcodes `trust_remote_code=True` when loading models from HuggingFace. This allows a remote attacker to achieve arbitrary Python code…
• CVE-2026-6855, published 2026-04-22. High severity, CVSS 7.1. EPSS: 0.2% chance of exploitation in the next 30 days. A flaw was found in InstructLab. A local attacker could exploit a path traversal vulnerability in the chat session handler by manipulating the `logs_dir` parameter. This allows the attacker to create…