6.3
Medium
CVE-2026-15063 A flaw was found in the gorch service template, which is part of the trustyai-service-operator
Description
A flaw was found in the gorch service template, which is part of the trustyai-service-operator. Even when authentication is enabled, the gorch service exposes unproxied orchestrator and detector metrics ports. This allows any pod on the cluster network to directly access these ports, bypassing the kube-rbac-proxy and its authentication mechanisms. This could lead to unauthorized access to the orchestrator and detector metrics.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| Red Hat OpenShift AI (RHOAI) | Versions not published | |
| trustyai-service-operator | Versions not published |
References
- access.redhat.com access.redhat.com
- RHBZ#2498058 bugzilla.redhat.com
Timeline
- Published
- Last modified
Other CVEs of Red Hat OpenShift AI (RHOAI)
The 339 CVEs of Red Hat OpenShift AI (RHOAI) →
CVE-2026-83494
Training-operator: pytorchjob validateupdate casts oldjob from newobj, bypassing managedby immutability (asvs v5.1.3; upstream bug)
Not rated
CVE-2026-83493
Distributed-workloads: github actions pinned by mutable tag/branch, including third-party snyk/actions/setup@master
Not rated
CVE-2026-107912
Io.quarkus/quarkus-vertx-http: quarkus-vertx-http: authorization bypass in management interface via path concatenation flaw
7.7
High
CVE-2026-120194
Json-glib: json-glib: infinite loop in json_path_query() with negative jsonpath slice step
7.5
High