VDB

CVE-2026-18982

CVE-2026-18982 PUBLISHED CVSS 8.8 HIGH

Reported by redhat · Published August 10, 2026

A flaw was found in the RHOAI training-operator. This vulnerability allows a user with standard edit or admin roles in any Kubernetes namespace to escalate their privileges. Through the creation of training jobs, an attacker can impersonate service accounts, access the host filesystem, and potentially execute arbitrary code remotely. This issue arises from the aggregation of training job permissions onto native Kubernetes edit and admin ClusterRoles, coupled with unrestricted PodTemplateSpec passthrough.

Risk Scores

CVSS 3.1
8.8
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Affected Products

VendorProductVersions
Red HatRed Hat OpenShift AI 2.251785187053
Red HatRed Hat OpenShift AI 3.31785188461
Red HatRed Hat OpenShift AI 3.41784814352
Red HatRed Hat OpenShift AI 3.41787361677
Red HatRed Hat OpenShift AI 3.51786552271
Red HatRed Hat OpenShift AI 3.51786552250
Red HatRed Hat OpenShift AI 3.41784814352, 1784814352, 1787361677
Red HatRed Hat OpenShift AI 3.51786552250
Red HatRed Hat OpenShift AI (RHOAI)
Red HatRed Hat OpenShift AI 2.251785187053, 1785187053, 1785187053
Red HatRed Hat OpenShift AI 3.31785188461, 1785188461, 1785188461
Red HatRed Hat OpenShift AI 3.51786552271

Timeline

  • Aug 10, 2026 CVE Published
  • Aug 11, 2026 Coalition ESS Score
  • Aug 14, 2026 CVE Updated
  • Aug 24, 2026 EPSS Score
  • Aug 26, 2026 EPSS Score
  • Aug 28, 2026 EPSS Score
  • Aug 30, 2026 EPSS Score
  • Sep 3, 2026 EPSS Score
  • Sep 6, 2026 EPSS Score
  • Sep 9, 2026 EPSS Score
  • Sep 12, 2026 EPSS Score
  • Sep 16, 2026 EPSS Score

References

Open in Interactive Console →
$ Console Community · 50/day Open console ›