CVE-2026-15467

Summary

A flaw was found in the trustyai-service-operator's LMEvalJob controller. An authenticated user within the cluster can exploit this vulnerability by configuring a sidecar container to bypass existing security policies. This allows the user to enable and execute untrusted remote code, leading to arbitrary code execution within the cluster.

Affected Software

VendorProductVersion RangeStatus
Red HatRed Hat OpenShift AI 2.251785187119 < *unaffected
Red HatRed Hat OpenShift AI 3.31785187521 < *unaffected
Red HatRed Hat OpenShift AI 3.41784993206 < *unaffected
Red HatRed Hat OpenShift AI 3.41786614608 < *unaffected
Red HatRed Hat OpenShift AI 3.51786552271 < *unaffected
Red HatRed Hat OpenShift AI 3.51786552250 < *unaffected

Weaknesses

  • CWE-266: Incorrect Privilege Assignment

ADP Enrichment

CISA ADP Vulnrichment

  • SSVC:
  • Exploitation: none
    • Automatable: no
    • Technical Impact: total

References