CVE-2026-15467

A flaw was found in the trustyai-service-operator's LMEvalJob controller. An authenticated user within the cluster can exploit this vulnerability by configuring a sidecar container to bypass existing security policies. This allows the user to enable and execute untrusted remote code, leading to arbitrary code execution within the cluster.

CVSS v3 8.1 HIGH

8.1^/10

CVSS v3 : HIGH

Vector :

Exploitability : 2.8 / Impact : 5.2

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://access.redhat.com/errata/RHSA-2026:53261
https://access.redhat.com/errata/RHSA-2026:53262
https://access.redhat.com/errata/RHSA-2026:53263
https://access.redhat.com/errata/RHSA-2026:60367
https://access.redhat.com/errata/RHSA-2026:60520
https://access.redhat.com/security/cve/CVE-2026-15467
https://bugzilla.redhat.com/show_bug.cgi?id=2499086

Configurations

No configuration.

History

21 Sep 2026, 11:17

Type	Values Removed	Values Added
References		() https://access.redhat.com/errata/RHSA-2026:60367 -

Information

Published : 2026-08-10 21:17

Updated : 2026-09-21 11:17

NVD link : CVE-2026-15467

Mitre link : CVE-2026-15467

CVE.ORG link : CVE-2026-15467

JSON object : View

Products Affected

No product.

CWE

CWE-266

Incorrect Privilege Assignment

{"id": "CVE-2026-15467", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-15467", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2026-08-12T15:42:12.978148Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "secalert@redhat.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.1, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 5.2, "exploitabilityScore": 2.8}]}, "affected": [{"source": "secalert@redhat.com", "affectedData": [{"cpes": ["cpe:/a:redhat:openshift_ai:2.25::el9"], "vendor": "Red Hat", "product": "Red Hat OpenShift AI 2.25", "versions": [{"status": "unaffected", "version": "1785187119", "lessThan": "*", "versionType": "rpm"}], "packageName": "rhoai/odh-trustyai-service-operator-rhel9", "collectionURL": "https://catalog.redhat.com/software/containers/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:openshift_ai:3.3::el9"], "vendor": "Red Hat", "product": "Red Hat OpenShift AI 3.3", "versions": [{"status": "unaffected", "version": "1785187521", "lessThan": "*", "versionType": "rpm"}], "packageName": "rhoai/odh-trustyai-service-operator-rhel9", "collectionURL": "https://catalog.redhat.com/software/containers/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:openshift_ai:3.4::el9"], "vendor": "Red Hat", "product": "Red Hat OpenShift AI 3.4", "versions": [{"status": "unaffected", "version": "1784993206", "lessThan": "*", "versionType": "rpm"}], "packageName": "rhoai/odh-trustyai-service-operator-rhel9", "collectionURL": "https://catalog.redhat.com/software/containers/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:openshift_ai:3.4::el9"], "vendor": "Red Hat", "product": "Red Hat OpenShift AI 3.4", "versions": [{"status": "unaffected", "version": "1786614608", "lessThan": "*", "versionType": "rpm"}], "packageName": "rhoai/odh-trustyai-service-operator-rhel9", "collectionURL": "https://catalog.redhat.com/software/containers/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:openshift_ai:3.5::el9"], "vendor": "Red Hat", "product": "Red Hat OpenShift AI 3.5", "versions": [{"status": "unaffected", "version": "1786552271", "lessThan": "*", "versionType": "rpm"}], "packageName": "rhoai/odh-latency-predictor-prediction-rhel9", "collectionURL": "https://catalog.redhat.com/software/containers/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:openshift_ai:3.5::el9"], "vendor": "Red Hat", "product": "Red Hat OpenShift AI 3.5", "versions": [{"status": "unaffected", "version": "1786552250", "lessThan": "*", "versionType": "rpm"}], "packageName": "rhoai/odh-latency-predictor-training-rhel9", "collectionURL": "https://catalog.redhat.com/software/containers/", "defaultStatus": "affected"}]}], "published": "2026-08-10T21:17:19.617", "references": [{"url": "https://access.redhat.com/errata/RHSA-2026:53261", "source": "secalert@redhat.com"}, {"url": "https://access.redhat.com/errata/RHSA-2026:53262", "source": "secalert@redhat.com"}, {"url": "https://access.redhat.com/errata/RHSA-2026:53263", "source": "secalert@redhat.com"}, {"url": "https://access.redhat.com/errata/RHSA-2026:60367", "source": "secalert@redhat.com"}, {"url": "https://access.redhat.com/errata/RHSA-2026:60520", "source": "secalert@redhat.com"}, {"url": "https://access.redhat.com/security/cve/CVE-2026-15467", "source": "secalert@redhat.com"}, {"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2499086", "source": "secalert@redhat.com"}], "vulnStatus": "Awaiting Analysis", "weaknesses": [{"type": "Secondary", "source": "secalert@redhat.com", "description": [{"lang": "en", "value": "CWE-266"}]}], "descriptions": [{"lang": "en", "value": "A flaw was found in the trustyai-service-operator's LMEvalJob controller. An authenticated user within the cluster can exploit this vulnerability by configuring a sidecar container to bypass existing security policies. This allows the user to enable and execute untrusted remote code, leading to arbitrary code execution within the cluster."}], "lastModified": "2026-09-21T11:17:07.533", "sourceIdentifier": "secalert@redhat.com"}