What is the CVSS score of CVE-2026-18951?

CVE-2026-18951 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.7%.

Which versions of OpenShift AI RHOAI are affected by CVE-2026-18951?

Red Hat OpenShift AI's training operator contains an authenticated privilege escalation vulnerability (CVSS 8.8) that allows namespace editors to escalate to arbitrary code execution on production…. A patch is available.

How to fix or mitigate CVE-2026-18951?

Within 24 hours, audit and restrict namespace editor role assignments in all RHOAI deployments to essential administrators only, and isolate affected RHOAI namespaces from production workloads via network policies. Within 7 days, implement RBAC controls removing trainjobs CRUD permissions from standard namespace editor ClusterRole, enable Kubernetes audit logging with real-time alerts on TrainJob resource modifications, and validate pod security policy restrictions prevent security context modifications. Within 30 days, subscribe to Red Hat Security Advisories for RHOAI updates and plan immediate deployment of any released patch to the training operator overlay.

OpenShift AI RHOAI CVE-2026-18951

EUVD-2026-55821 HIGH

Improper Access Control (CWE-284)

2026-08-10 redhat

GHSA-h7xh-qc2m-rc58

Authentication Bypass RCE Kubernetes Red Hat Red Hat Openshift Ai Rhoai Red Hat

8.8

CVSS 3.1 · Vendor: redhat

Severity by source

Vendor (redhat) PRIMARY

8.8 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

7.5 HIGH

AC:H reflects the real-world requirement to chain TRN-01 for full impact; all other metrics match vendor assessment given authenticated namespace editor access and network-reachable Kubernetes API.

3.1 AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:H/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Red Hat

8.8 CRITICAL

qualitative

Primary rating from Vendor (redhat).

CVSS VectorVendor: redhat

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Aug 10, 2026 - 21:24 vuln.today

CVE Published

Aug 10, 2026 - 20:45 nvd

HIGH 8.8

DescriptionCVE.org

A flaw was found in the Red Hat OpenShift AI (RHOAI) overlay for the training operator. The RHOAI overlay incorrectly aggregates trainjobs management permissions into the native Kubernetes edit ClusterRole. This allows any user with edit ClusterRole permissions in a namespace to create, modify, and delete TrainJobs. When combined with a separate vulnerability (TRN-01) that permits arbitrary pod configurations, a remote attacker with namespace editor privileges could exploit this to escalate privileges, potentially leading to arbitrary code execution.

Articles & Coverage 1

News 4 New Kubernetes Vulnerabilities - 1 Critical, 3 High Severity Aug 11, 2026

AnalysisAI

Privilege escalation in Red Hat OpenShift AI (RHOAI) training operator overlay allows any namespace editor to manage TrainJob resources beyond their intended authorization scope. The RHOAI overlay incorrectly injects trainjobs CRUD permissions into the native Kubernetes edit ClusterRole, violating the principle of least privilege. When chained with a companion flaw (TRN-01) that permits arbitrary pod configuration within TrainJobs, a remote attacker holding namespace editor credentials could escalate to arbitrary code execution - no public exploit is identified at time of analysis, and KEV listing has not been confirmed.

Technical ContextAI

Red Hat OpenShift AI (RHOAI) extends the upstream Kubeflow Training Operator with a custom overlay that modifies Kubernetes RBAC ClusterRole aggregation rules. Kubernetes uses label-based ClusterRole aggregation to compose platform roles such as edit; any ClusterRole carrying the label rbac.authorization.k8s.io/aggregate-to-edit: true automatically grants its rules to all edit bindings cluster-wide. The RHOAI overlay incorrectly labels the trainjobs resource rules with this aggregation marker, expanding the blast radius of the standard edit role beyond its upstream definition. The affected CPE is cpe:2.3:a:red_hat:red_hat_openshift_ai_(rhoai):*:*:*:*:*:*:*:* - the wildcard version component indicates no specific fixed version is identified in NVD CPE data. No CWE was assigned by the reporter; the nearest applicable class is CWE-269 (Improper Privilege Management) or CWE-732 (Incorrect Permission Assignment for Critical Resource).

RemediationAI

No vendor-released patch with an exact fixed version is identified at time of analysis based on available reference data. Consult the Red Hat advisory at https://access.redhat.com/security/cve/CVE-2026-18951 and https://bugzilla.redhat.com/show_bug.cgi?id=2511187 for patch availability updates. As a compensating control, audit all ClusterRoleBinding objects granting the edit ClusterRole within RHOAI-enabled namespaces and restrict namespace edit bindings to explicitly trusted accounts; the trade-off is operational friction for ML engineers who rely on broad edit permissions. Separately, restrict or disable the RHOAI training operator overlay if TrainJob functionality is not actively required, which eliminates the aggregated permission entirely. Additionally, remediate TRN-01 independently, as it is the enabler of arbitrary pod configuration that converts this privilege escalation into code execution.