EUVD-2026-55810
GHSA-7rjm-5cpg-vwpq
Severity by source
AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
AV:A because exploitation requires a pod on the cluster network; PR:L because deploying a pod is a low-privilege tenant capability; full CIA because the unprotected API permits read, write, and delete operations.
Primary rating from Vendor (redhat).
CVSS VectorVendor: redhat
CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
2DescriptionCVE.org
A flaw was found in the TrustyAI Service (TAS) deployment. This vulnerability allows any pod on the cluster network to bypass authentication and directly access the TAS backend API. An attacker can exploit this to read, tamper with, or delete monitoring data and configurations, and inject arbitrary data into the service, potentially disrupting tenant operations.
AnalysisAI
Authentication bypass in TrustyAI Service (TAS) within Red Hat OpenShift AI (RHOAI) exposes the backend API to any pod on the cluster network without requiring valid credentials. The CVSS vector (AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) confirms that an attacker with a pod on the cluster-such as through a compromised workload or a malicious tenant pod in a multi-tenant deployment-can read, modify, delete, or poison AI model monitoring data and configurations with no additional barriers. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | The attacker must have a pod running on the OpenShift cluster network-achievable with standard tenant-level cluster access (PR:L in CVSS), such as the ability to deploy workloads in any namespace. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS score of 8.0 with AV:A reflects that this is not remotely exploitable from the internet without prior cluster access, which moderates its absolute priority compared to AV:N vulnerabilities. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | A threat actor operating a pod within the OpenShift cluster-whether through a compromised CI/CD runner, a malicious dependency in a tenant workload, or direct tenant access-identifies the TrustyAI Service internal ClusterIP endpoint via DNS resolution or cluster service discovery. The attacker sends direct HTTP requests to the TAS API without any authentication token, successfully reading model fairness metrics for other tenants, injecting falsified monitoring data to suppress bias alerts, and deleting historical drift records to cover tracks or disrupt observability. … |
| Remediation | No exact patched version was identified in the available intelligence data; operators should consult the Red Hat advisory at https://access.redhat.com/security/cve/CVE-2026-15581 and monitor https://bugzilla.redhat.com/show_bug.cgi?id=2499637 for patch availability and confirmed fix versions. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: Audit all TrustyAI Service deployments and identify cluster pods with network access to TAS backends. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Red Hat Openshift Ai Rhoai
View allUnauthenticated remote code execution affects Feast (the open-source ML feature store), where user-defined functions sto
Authentication bypass in the Models-as-a-Service (MaaS) API component of Red Hat OpenShift AI (RHOAI) lets any pod alrea
Kubernetes Service Account token disclosure in the odh-dashboard component of Red Hat OpenShift AI (RHOAI) lets an authe
Server-side request forgery in the file_type content detector of guardrails-detectors (a component shipped with Red Hat
Arbitrary file write in the Feast Feature Server's `/save-document` endpoint lets an unauthenticated remote attacker wri
Privilege escalation in Red Hat OpenShift AI (RHOAI) training operator overlay allows any namespace editor to manage Tra
Privilege escalation in Red Hat OpenShift AI's training-operator enables any user holding a standard Kubernetes edit or
MySQL DSN parameter injection in Red Hat OpenShift AI's Data Science Pipelines Operator (DSPO) allows a namespace editor
Privilege escalation in odh-dashboard, the web interface for Red Hat OpenShift AI (RHOAI), allows any authenticated dash
Privilege escalation in odh-dashboard (Red Hat OpenShift AI) allows an attacker who has obtained the dashboard's Service
The MaaS (Model-as-a-Service) Gateway component in Red Hat OpenShift AI (RHOAI) is improperly configured, enabling any l
Authentication bypass in the odh-dashboard web console of Red Hat OpenShift AI (RHOAI) lets a low-privileged actor alrea
Same technique Authentication Bypass
View allVendor StatusVendor
Share
External POC / Exploit Code
Leaving vuln.today