6.3
Medium
CVE-2026-15044 A flaw was found in the TrustyAI Service Operator
Description
A flaw was found in the TrustyAI Service Operator. When deploying services like gorch or NemoGuardrails, if a specific security setting is not enabled, these services can expose their communication channels without requiring users to prove their identity. This allows any other program within the cluster to access the AI guardrails and orchestrator without proper authorization. An attacker could exploit this to gain unauthorized access to sensitive information and potentially make limited changes to the AI models.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| Red Hat OpenShift AI (RHOAI) | Versions not published | |
| trustyai-service-operator | Versions not published |
References
- access.redhat.com access.redhat.com
- RHBZ#2498039 bugzilla.redhat.com
Timeline
- Published
- Last modified
Other CVEs of Red Hat OpenShift AI (RHOAI)
The 388 CVEs of Red Hat OpenShift AI (RHOAI) →
CVE-2026-83494
Training-operator: pytorchjob validateupdate casts oldjob from newobj, bypassing managedby immutability (asvs v5.1.3; upstream bug)
Not rated
CVE-2026-83493
Distributed-workloads: github actions pinned by mutable tag/branch, including third-party snyk/actions/setup@master
Not rated
CVE-2026-107912
Io.quarkus/quarkus-vertx-http: quarkus-vertx-http: authorization bypass in management interface via path concatenation flaw
7.7
High
CVE-2026-120194
Json-glib: json-glib: infinite loop in json_path_query() with negative jsonpath slice step
7.5
High