EUVD-2026-42293
GHSA-qhhg-cg26-g7r4
Severity by source
AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N
Adjacent vector because exploitation is confined to the Kubernetes cluster network; PR:L because a running pod is required; C:H for exposed metrics data; I:L per provided vector, A:N as no denial of service is described.
Primary rating from Vendor (redhat).
CVSS VectorVendor: redhat
Lifecycle Timeline
1DescriptionCVE.org
A flaw was found in the gorch service template, which is part of the trustyai-service-operator. Even when authentication is enabled, the gorch service exposes unproxied orchestrator and detector metrics ports. This allows any pod on the cluster network to directly access these ports, bypassing the kube-rbac-proxy and its authentication mechanisms. This could lead to unauthorized access to the orchestrator and detector metrics.
AnalysisAI
Unproxied metrics port exposure in the gorch service template of trustyai-service-operator (part of Red Hat OpenShift AI) allows any pod on the cluster network to access orchestrator and detector metrics endpoints while bypassing kube-rbac-proxy authentication. The flaw manifests specifically when authentication is enabled - the configuration that should be protective is the same one under which the bypass exists. CVSS PR:L confirms exploitation requires a pod already running on the cluster network, limiting blast radius to actors with at least minimal cluster access. No public exploit code identified and no CISA KEV listing at time of analysis.
Technical ContextAI
The affected component is the gorch service template within trustyai-service-operator, an operator managing TrustyAI services in Red Hat OpenShift AI (RHOAI), identified by CPE cpe:2.3:a:red_hat:red_hat_openshift_ai_(rhoai):*:*:*:*:*:*:*:*. kube-rbac-proxy is a Kubernetes sidecar pattern that interposes between clients and backend services, enforcing Kubernetes RBAC-based authentication. CWE-306 (Missing Authentication for Critical Function) describes the root cause: the gorch service template fails to route orchestrator and detector metrics ports through the kube-rbac-proxy sidecar, leaving them directly reachable on the pod network. Even when the operator is configured with authentication enabled, these specific ports are unproxied, so the authentication enforcement layer is never invoked for metrics traffic.
RemediationAI
Check the Red Hat advisory at https://access.redhat.com/security/cve/CVE-2026-15063 for patch availability, as no specific fixed version was confirmed in the available data at time of analysis. As a compensating control, apply Kubernetes NetworkPolicy rules to restrict pod-to-pod traffic to the gorch service's metrics ports (typically Prometheus scrape ports such as 8080 or 9090), limiting access to only the monitoring namespace or authorized scraper pods - this directly blocks the unproxied lateral access path without requiring an operator upgrade. Additionally, audit existing cluster workloads for any that have already accessed these metrics ports unexpectedly using cluster network flow logs or service mesh telemetry. Be aware that NetworkPolicy restrictions may break legitimate metrics collection if the scrape configuration is not updated accordingly.
More in Red Hat Openshift Ai Rhoai
View allThe Feast Feature Server contains a path traversal vulnerability in its `/read-document` endpoint that allows unauthenti
Unauthenticated remote code execution affects Feast (the open-source ML feature store), where user-defined functions sto
Authentication bypass in the Models-as-a-Service (MaaS) API component of Red Hat OpenShift AI (RHOAI) lets any pod alrea
Kubernetes Service Account token disclosure in the odh-dashboard component of Red Hat OpenShift AI (RHOAI) lets an authe
Server-side request forgery in the file_type content detector of guardrails-detectors (a component shipped with Red Hat
Arbitrary file write in the Feast Feature Server's `/save-document` endpoint lets an unauthenticated remote attacker wri
Privilege escalation in Red Hat OpenShift AI (RHOAI) training operator overlay allows any namespace editor to manage Tra
Privilege escalation in Red Hat OpenShift AI's training-operator enables any user holding a standard Kubernetes edit or
MySQL DSN parameter injection in Red Hat OpenShift AI's Data Science Pipelines Operator (DSPO) allows a namespace editor
Privilege escalation in odh-dashboard, the web interface for Red Hat OpenShift AI (RHOAI), allows any authenticated dash
Privilege escalation in odh-dashboard (Red Hat OpenShift AI) allows an attacker who has obtained the dashboard's Service
The MaaS (Model-as-a-Service) Gateway component in Red Hat OpenShift AI (RHOAI) is improperly configured, enabling any l
Same technique Authentication Bypass
View allVendor StatusVendor
Share
External POC / Exploit Code
Leaving vuln.today