CVE-2026-15063

A flaw was found in the gorch service template, which is part of the trustyai-service-operator. Even when authentication is enabled, the gorch service exposes unproxied orchestrator and detector metrics ports. This allows any pod on the cluster network to directly access these ports, bypassing the kube-rbac-proxy and its authentication mechanisms. This could lead to unauthorized access to the orchestrator and detector metrics.

CVSS v3 6.3 MEDIUM

6.3^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.1 / Impact : 4.2

Attack Vector ADJACENT_NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact LOW

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://access.redhat.com/security/cve/CVE-2026-15063
https://bugzilla.redhat.com/show_bug.cgi?id=2498058

Configurations

No configuration.

History

25 Oct 2026, 20:10

Type	Values Removed	Values Added
Summary		(es) Se encontró una falla en la plantilla del servicio gorch, que forma parte del trustyai-service-operator. Incluso cuando la autenticación está habilitada, el servicio gorch expone puertos de métricas de orquestador y detector sin proxy. Esto permite a cualquier pod en la red del clúster acceder directamente a estos puertos, eludiendo el kube-rbac-proxy y sus mecanismos de autenticación. Esto podría llevar a un acceso no autorizado a las métricas del orquestador y del detector.

Information

Published : 2026-07-08 16:16

Updated : 2026-10-25 20:10

NVD link : CVE-2026-15063

Mitre link : CVE-2026-15063

CVE.ORG link : CVE-2026-15063

JSON object : View

Products Affected

No product.

CWE

CWE-306

Missing Authentication for Critical Function

{"id": "CVE-2026-15063", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-15063", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-07-08T15:56:03.613145Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "secalert@redhat.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.3, "attackVector": "ADJACENT_NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 4.2, "exploitabilityScore": 2.1}]}, "affected": [{"source": "secalert@redhat.com", "affectedData": [{"vendor": "trustyai-explainability", "product": "trustyai-service-operator", "versions": [{"status": "affected", "version": "0", "lessThan": "*", "versionType": "semver"}], "packageName": "trustyai-service-operator", "collectionURL": "https://github.com/trustyai-explainability/trustyai-service-operator", "defaultStatus": "unaffected"}, {"cpes": ["cpe:/a:redhat:openshift_ai"], "vendor": "Red Hat", "product": "Red Hat OpenShift AI (RHOAI)", "packageName": "rhoai/odh-trustyai-service-operator-rhel9", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected"}]}], "published": "2026-07-08T16:16:27.723", "references": [{"url": "https://access.redhat.com/security/cve/CVE-2026-15063", "source": "secalert@redhat.com"}, {"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2498058", "source": "secalert@redhat.com"}], "vulnStatus": "Awaiting Analysis", "weaknesses": [{"type": "Secondary", "source": "secalert@redhat.com", "description": [{"lang": "en", "value": "CWE-306"}]}], "descriptions": [{"lang": "en", "value": "A flaw was found in the gorch service template, which is part of the trustyai-service-operator. Even when authentication is enabled, the gorch service exposes unproxied orchestrator and detector metrics ports. This allows any pod on the cluster network to directly access these ports, bypassing the kube-rbac-proxy and its authentication mechanisms. This could lead to unauthorized access to the orchestrator and detector metrics."}, {"lang": "es", "value": "Se encontr\u00f3 una falla en la plantilla del servicio gorch, que forma parte del trustyai-service-operator. Incluso cuando la autenticaci\u00f3n est\u00e1 habilitada, el servicio gorch expone puertos de m\u00e9tricas de orquestador y detector sin proxy. Esto permite a cualquier pod en la red del cl\u00faster acceder directamente a estos puertos, eludiendo el kube-rbac-proxy y sus mecanismos de autenticaci\u00f3n. Esto podr\u00eda llevar a un acceso no autorizado a las m\u00e9tricas del orquestador y del detector."}], "lastModified": "2026-10-25T20:10:00.147", "sourceIdentifier": "secalert@redhat.com"}