VDB
RHSA-2026:73987
RHSA-2026:73987
PUBLISHED
CVSS 8.100000381469727 HIGH
A flaw was found in the Red Hat OpenShift AI (RHOAI) overlay for the training operator. The RHOAI overlay incorrectly aggregates `trainjobs` management permissions into the native Kubernetes `edit ClusterRole`. This allows any user with `edit ClusterRole` permissions in a namespace to create, modify, and delete `TrainJobs`. When combined with a separate vulnerability (TRN-01) that permits arbitrary pod configurations, a remote attacker with namespace editor privileges could exploit this to escalate privileges, potentially leading to arbitrary code execution.
Risk Scores
CVSS 3.1
8.100000381469727
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Red Hat | registry.redhat.io/rhoai/odh-mod-arch-gen-ai-rhel9@sha256:5370a75973d1c0bdba5ab881260ffefbd03f1c604b4683d84b291a770543be35_ppc64le as a component of Red Hat OpenShift AI 3.3 | * |
| Red Hat | registry.redhat.io/rhoai/odh-trustyai-nemo-guardrails-server-rhel9@sha256:e960e3601f388e87901c41aeaa8bb3f0634cd1e9d594bffc8d2a6047334c5488_amd64 as a component of Red Hat OpenShift AI 3.3 | * |
| Red Hat | registry.redhat.io/rhoai/odh-llm-d-inference-scheduler-rhel9@sha256:53e99ddfe33c7043dd0756af31e1467d7ee7502ec36b279b7cc6e27d30b5004f_arm64 as a component of Red Hat OpenShift AI 3.3 | * |
| Red Hat | registry.redhat.io/rhoai/odh-mlmd-grpc-server-rhel9@sha256:799d0fccb12a684bf9cdaaed1ed49150a8c6e83b902a33dd64daadd40d70be0f_ppc64le as a component of Red Hat OpenShift AI 3.3 | * |
| Red Hat | registry.redhat.io/rhoai/odh-pipeline-runtime-pytorch-rocm-py312-rhel9@sha256:9197af601fb8a44d65490a219474717de7257afa427b32fe85a921a45d00d38e_amd64 as a component of Red Hat OpenShift AI 3.3 | * |
| Red Hat | registry.redhat.io/rhoai/odh-dashboard-rhel9@sha256:34be19a6a0bc7ad5c47f85d4f0b676df88211d0687e5ff3853c8b9e901e6d542_arm64 as a component of Red Hat OpenShift AI 3.3 | * |
| Red Hat | registry.redhat.io/rhoai/odh-ml-pipelines-driver-rhel9@sha256:98aaef94a541d4d47c1474194168c007a74a8731078c2d38d2b7b4fd033546cc_amd64 as a component of Red Hat OpenShift AI 3.3 | * |
| Red Hat | registry.redhat.io/rhoai/odh-ml-pipelines-driver-rhel9@sha256:3d3a2184e09c8860be999abb8e6670736bb9aed9ba5252858daba90dc502f3bb_arm64 as a component of Red Hat OpenShift AI 3.3 | * |
| Red Hat | registry.redhat.io/rhoai/odh-guardrails-detector-huggingface-runtime-rhel9@sha256:50c3d6f9fa2dc46b56739c22ca4e2df29497629b9121bee130caf89571901129_ppc64le as a component of Red Hat OpenShift AI 3.3 | * |
| Red Hat | registry.redhat.io/rhoai/odh-model-controller-rhel9@sha256:b0d2cb1ccf3e2fa064ada64c408ac5a4f7a445ab7381a52e3af0f6221bd9e6fd_arm64 as a component of Red Hat OpenShift AI 3.3 | * |
| Red Hat | registry.redhat.io/rhoai/odh-dashboard-rhel9@sha256:c0bb08d3dea2add89b39261feac7775ca35b26cd294f8ae7f8dc02c4967676f9_amd64 as a component of Red Hat OpenShift AI 3.3 | * |
| Red Hat | registry.redhat.io/rhoai/odh-llm-d-routing-sidecar-rhel9@sha256:7d373b1677b8581fb131fb2c2f2b2fd9008b5f08352998acdb8d3724e5a578a2_amd64 as a component of Red Hat OpenShift AI 3.3 | *, *, * |
| Red Hat | registry.redhat.io/rhoai/odh-workbench-jupyter-tensorflow-rocm-py312-rhel9@sha256:d695b04c37d2ba40fb4e4fbfdd2f75437797b3478c4a951b6496fb472a0c2ca9_amd64 as a component of Red Hat OpenShift AI 3.3 | *, *, * |
| Red Hat | registry.redhat.io/rhoai/odh-mod-arch-maas-rhel9@sha256:9fbd6ce682a8d4c78a2cb6874d038739a4960f6a24238fa8715b987342723167_ppc64le as a component of Red Hat OpenShift AI 3.3 | *, *, * |
| Red Hat | registry.redhat.io/rhoai/odh-workbench-jupyter-minimal-cpu-py312-rhel9@sha256:935aa4a4d14226d2b4d45da50e63a4168b2079efbddfe2a739ad20e8b50a4493_arm64 as a component of Red Hat OpenShift AI 3.3 | *, *, * |
| Red Hat | registry.redhat.io/rhoai/odh-workbench-jupyter-trustyai-cpu-py312-rhel9@sha256:11777294a8a10f9d6cc5e9d16920f81f45dba952cb47c44c47b5b9a356bc7aa8_arm64 as a component of Red Hat OpenShift AI 3.3 | * |
| Red Hat | registry.redhat.io/rhoai/odh-workbench-jupyter-datascience-cpu-py312-rhel9@sha256:8f46c12c1d0469bd16d0a076778c419910203849819401d85aac6d126c925c03_ppc64le as a component of Red Hat OpenShift AI 3.3 | * |
| Red Hat | registry.redhat.io/rhoai/odh-model-registry-operator-rhel9@sha256:80ad1219216856b408dae3940f6a84228116c59af594bfac41859f308774959b_ppc64le as a component of Red Hat OpenShift AI 3.3 | * |
| Red Hat | registry.redhat.io/rhoai/odh-must-gather-rhel9@sha256:33b7b8f23b9628b0e5b982320c0bf91c536592a362aa7e57d3901a482b7a39fb_s390x as a component of Red Hat OpenShift AI 3.3 | * |
| Red Hat | registry.redhat.io/rhoai/odh-kf-notebook-controller-rhel9@sha256:1262e306b488c1a1080e7fba84d890dd07820f785a5c166532a70deb44ca8a0e_s390x as a component of Red Hat OpenShift AI 3.3 | * |
…and 215 more
Timeline
- Sep 30, 2026 CVE Published
- Oct 15, 2026 Security Advisory
- Oct 26, 2026 CVE Updated
- Oct 26, 2026 Distribution Patch
- Oct 26, 2026 Distribution Patch
- Oct 26, 2026 Security Advisory
- Oct 26, 2026 Security Advisory
- Oct 26, 2026 Security Advisory
- Oct 26, 2026 Security Advisory
- Oct 26, 2026 Security Advisory
- Oct 26, 2026 Security Advisory
- Oct 26, 2026 Security Advisory
References
- https://bugzilla.redhat.com/show_bug.cgi?id=2521337 issue
- https://nvd.nist.gov/vuln/detail/CVE-2026-63310 advisory
- https://github.com/nltk/nltk/security/advisories/GHSA-5wp5-5229-5g6q advisory
- https://www.vulncheck.com/advisories/nltk-before-missing-post-download-integrity-verification advisory
- https://access.redhat.com/errata/RHSA-2026:73987 advisory
- https://access.redhat.com/security/cve/CVE-2025-61726 advisory
- https://access.redhat.com/security/cve/CVE-2025-66471 advisory
- https://access.redhat.com/security/cve/CVE-2025-71408 advisory
- https://access.redhat.com/security/cve/CVE-2026-11816 advisory
- https://access.redhat.com/security/cve/CVE-2026-11822 advisory
- https://access.redhat.com/security/cve/CVE-2026-11824 advisory
- https://access.redhat.com/security/cve/CVE-2026-12151 advisory
- https://access.redhat.com/security/cve/CVE-2026-13149 advisory
- https://access.redhat.com/security/cve/CVE-2026-15154 advisory
- https://access.redhat.com/security/cve/CVE-2026-1525 advisory
- https://access.redhat.com/security/cve/CVE-2026-1526 advisory
- https://access.redhat.com/security/cve/CVE-2026-1528 advisory
- https://access.redhat.com/security/cve/CVE-2026-15378 advisory
- https://access.redhat.com/security/cve/CVE-2026-16221 advisory
- https://access.redhat.com/security/cve/CVE-2026-16745 advisory
…and 819 more