EUVD-2026-55809
GHSA-qw34-v3jw-3crv
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
Network-accessible via Kubernetes API with low privileges required; scope unchanged as execution is pod-local; no availability impact described.
Primary rating from Vendor (redhat).
CVSS VectorVendor: redhat
Lifecycle Timeline
2DescriptionCVE.org
A flaw was found in the trustyai-service-operator's LMEvalJob controller. An authenticated user within the cluster can exploit this vulnerability by configuring a sidecar container to bypass existing security policies. This allows the user to enable and execute untrusted remote code, leading to arbitrary code execution within the cluster.
AnalysisAI
Arbitrary code execution in Red Hat OpenShift AI's trustyai-service-operator enables authenticated cluster users to bypass pod security policies via crafted sidecar container configurations in LMEvalJob resources. The CVSS 8.1 (High) score reflects network-accessible exploitation requiring only low-privilege cluster authentication, with high confidentiality and integrity impact against the affected workload context. No public exploit code has been identified and no CISA KEV listing exists at time of analysis, but the low barrier of entry (any authenticated cluster user) elevates insider-threat and compromised-account risk for RHOAI deployments.
Technical ContextAI
The trustyai-service-operator is a Kubernetes operator within Red Hat OpenShift AI (RHOAI) that manages LMEvalJob custom resources for running AI model evaluation workloads. CWE-266 (Incorrect Privilege Assignment) identifies the root cause: the LMEvalJob controller fails to adequately validate or restrict sidecar container specifications submitted by users, allowing them to inject containers with escalated capabilities or security context settings that circumvent admission controls or pod security standards. In Kubernetes/OpenShift, sidecar containers share the pod's network and optionally process namespace, making them a vector for security boundary violations. The affected CPE - cpe:2.3:a:red_hat:red_hat_openshift_ai_(rhoai):*:*:*:*:*:* - uses a wildcard version, indicating the issue is not yet bounded to a specific release range per NVD data.
RemediationAI
The primary remediation is to apply the vendor patch from Red Hat once released; consult https://access.redhat.com/security/cve/CVE-2026-15467 for the official advisory and exact fixed version, as no specific patched release version was confirmed in the available data. As an interim compensating control, restrict RBAC permissions to create, update, or patch LMEvalJob resources to only highly trusted users or service accounts - this does not eliminate the flaw but limits the population of potential attackers. Additionally, enforce OpenShift Pod Security Admission or a policy engine (e.g., Kyverno, OPA/Gatekeeper) to block sidecar container configurations that request elevated security contexts or privileged capabilities; note that this may require custom policy authoring and could interfere with legitimate evaluation jobs if policies are overly broad. Monitor the trustyai-service-operator namespace for anomalous container image pulls or outbound network connections from LMEvalJob pods as a detection measure.
More in Red Hat Openshift Ai Rhoai
View allThe Feast Feature Server contains a path traversal vulnerability in its `/read-document` endpoint that allows unauthenti
Unauthenticated remote code execution affects Feast (the open-source ML feature store), where user-defined functions sto
Authentication bypass in the Models-as-a-Service (MaaS) API component of Red Hat OpenShift AI (RHOAI) lets any pod alrea
Kubernetes Service Account token disclosure in the odh-dashboard component of Red Hat OpenShift AI (RHOAI) lets an authe
Server-side request forgery in the file_type content detector of guardrails-detectors (a component shipped with Red Hat
Arbitrary file write in the Feast Feature Server's `/save-document` endpoint lets an unauthenticated remote attacker wri
Privilege escalation in Red Hat OpenShift AI (RHOAI) training operator overlay allows any namespace editor to manage Tra
Privilege escalation in Red Hat OpenShift AI's training-operator enables any user holding a standard Kubernetes edit or
MySQL DSN parameter injection in Red Hat OpenShift AI's Data Science Pipelines Operator (DSPO) allows a namespace editor
Privilege escalation in odh-dashboard, the web interface for Red Hat OpenShift AI (RHOAI), allows any authenticated dash
Privilege escalation in odh-dashboard (Red Hat OpenShift AI) allows an attacker who has obtained the dashboard's Service
The MaaS (Model-as-a-Service) Gateway component in Red Hat OpenShift AI (RHOAI) is improperly configured, enabling any l
Same weakness CWE-266 – Incorrect Privilege Assignment
View allVendor StatusVendor
Share
External POC / Exploit Code
Leaving vuln.today