VDB

CVE-2026-15467

CVE-2026-15467 PUBLISHED CVSS 8.1 HIGH

Reported by redhat · Published August 10, 2026

A flaw was found in the trustyai-service-operator's LMEvalJob controller. An authenticated user within the cluster can exploit this vulnerability by configuring a sidecar container to bypass existing security policies. This allows the user to enable and execute untrusted remote code, leading to arbitrary code execution within the cluster.

Risk Scores

CVSS 3.1
8.1
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

Affected Products

VendorProductVersions
Red HatRed Hat OpenShift AI 2.251785187119
Red HatRed Hat OpenShift AI 3.31785187521
Red HatRed Hat OpenShift AI 3.41784993206
Red HatRed Hat OpenShift AI 3.41786614608
Red HatRed Hat OpenShift AI 3.51786552271
Red HatRed Hat OpenShift AI 3.51786552250
Red HatRed Hat OpenShift AI 3.41786614608, 1784993206
Red HatRed Hat OpenShift AI 3.51786552250
Red HatRed Hat OpenShift AI 3.31785187521
Red HatRed Hat OpenShift AI 2.251785187119
Red HatRed Hat OpenShift AI 3.51786552271
Red HatRed Hat OpenShift AI (RHOAI)

Timeline

  • Aug 10, 2026 CVE Published
  • Aug 11, 2026 Coalition ESS Score
  • Aug 24, 2026 EPSS Score
  • Aug 26, 2026 EPSS Score
  • Aug 28, 2026 EPSS Score
  • Aug 30, 2026 EPSS Score
  • Sep 3, 2026 EPSS Score
  • Sep 6, 2026 EPSS Score
  • Sep 9, 2026 EPSS Score
  • Sep 12, 2026 EPSS Score
  • Sep 16, 2026 EPSS Score
  • Sep 18, 2026 EPSS Score

References

Open in Interactive Console →
$ Console Community · 50/day Open console ›