What is the CVSS score of CVE-2026-18982?

CVE-2026-18982 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.5%.

Which versions of RHOAI training-operator are affected by CVE-2026-18982?

Red Hat OpenShift AI's training-operator contains a privilege escalation vulnerability (CVSS 8.8) with no public exploit identified at time of analysis.. A patch is available.

How to fix or mitigate CVE-2026-18982?

Within 24 hours: identify all Red Hat OpenShift AI deployments in your environment and audit which teams and users hold edit and admin roles across namespaces; begin restricting those roles to principle-of-least-privilege. Within 7 days: implement network micro-segmentation isolating OpenShift AI training workloads from critical systems, deploy Pod Security Policies to block hostPath mounts and privileged containers, and enable audit logging on service account token access. Within 30 days: migrate to Red Hat's patched version of OpenShift AI when available, conduct forensic review of access logs for suspicious namespace-crossing activity or service account impersonation, and validate compensating controls are functioning.

RHOAI training-operator CVE-2026-18982

EUVD-2026-55822 HIGH

Execution with Unnecessary Privileges (CWE-250)

2026-08-10 redhat

GHSA-v6pg-cp3x-x49r

Privilege Escalation RCE Kubernetes Red Hat Openshift Ai Rhoai Red Hat

8.8

CVSS 3.1 · Vendor: redhat

Severity by source

Vendor (redhat) PRIMARY

8.8 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

9.9 CRITICAL

S:C assigned over vendor's S:U because host filesystem access demonstrably crosses pod/namespace isolation to the underlying node, affecting components outside the vulnerable namespace.

3.1 AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

Red Hat

8.8 CRITICAL

qualitative

Primary rating from Vendor (redhat).

CVSS VectorVendor: redhat

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Aug 10, 2026 - 21:24 vuln.today

CVE Published

Aug 10, 2026 - 20:45 nvd

HIGH 8.8

DescriptionCVE.org

A flaw was found in the RHOAI training-operator. This vulnerability allows a user with standard edit or admin roles in any Kubernetes namespace to escalate their privileges. Through the creation of training jobs, an attacker can impersonate service accounts, access the host filesystem, and potentially execute arbitrary code remotely. This issue arises from the aggregation of training job permissions onto native Kubernetes edit and admin ClusterRoles, coupled with unrestricted PodTemplateSpec passthrough.

Articles & Coverage 1

News 4 New Kubernetes Vulnerabilities - 1 Critical, 3 High Severity Aug 11, 2026

AnalysisAI

Privilege escalation in Red Hat OpenShift AI's training-operator enables any user holding a standard Kubernetes edit or admin role in any cluster namespace to break out of namespace isolation, impersonate service accounts, access the host filesystem, and achieve remote code execution. The root cause is a design flaw: the operator aggregates training job permissions onto native Kubernetes built-in ClusterRoles, and allows unrestricted PodTemplateSpec passthrough - meaning users can submit training jobs containing arbitrary pod configurations such as hostPath mounts or elevated service account tokens. No public exploit code or CISA KEV listing was identified at time of analysis, but the low access complexity and the broad availability of edit/admin roles in typical ML platform deployments make this an urgent remediation priority.

Technical ContextAI

Red Hat OpenShift AI (RHOAI) includes a training-operator component that manages distributed machine learning training jobs as Kubernetes custom resources. The affected product is identified by CPE cpe:2.3:a:red_hat:red_hat_openshift_ai_(rhoai):*:*:*:*:*:*:*:*, covering all versions. The root cause class is CWE-250 (Execution with Unnecessary Privileges): the operator extends the built-in Kubernetes edit and admin ClusterRoles by aggregating training job RBAC permissions onto them - a Kubernetes aggregation feature intended for controlled extension but here used too broadly. Because the operator does not sanitize or restrict the PodTemplateSpec submitted with training jobs, a user with only namespace-scoped edit/admin access can craft a job that mounts host paths, injects privileged tokens, or specifies a service account with elevated cluster-level permissions. This breaks the Kubernetes security boundary between namespace isolation and the underlying node.

RemediationAI

The primary remediation is to apply Red Hat's official patch for RHOAI once released; monitor https://access.redhat.com/security/cve/CVE-2026-18982 for the patched version, as no exact fix version was confirmed from the provided data. As immediate compensating controls pending a patch: audit all namespace-level RoleBindings and ClusterRoleBindings that grant edit or admin roles and restrict them to only verified, trusted users - this reduces the pool of principals who can trigger the vulnerability. Deploy an admission controller such as OPA Gatekeeper or Kyverno with policies that reject training job PodTemplateSpecs containing hostPath volumes, hostPID/hostNetwork flags, or service account names other than the default; note that this may disrupt legitimate training workloads that use host-local storage and should be tested against existing pipelines before enforcement. Review and manually tighten the ClusterRole aggregation rules added by the training-operator to remove unnecessary permissions. These controls reduce but do not eliminate risk; the underlying design flaw in ClusterRole aggregation and PodTemplateSpec passthrough remains until patched.