Skip to content
CVE PROGRAM SOURCE RECORD8.1 High

CVE-2026-15467

Trustyai-service-operator: trustyai-service-operator: lmevaljob sidecar containers bypass protected environment variable filtering, allowing trust_remote_code policy override

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
redhat

Description

A flaw was found in the trustyai-service-operator's LMEvalJob controller. An authenticated user within the cluster can exploit this vulnerability by configuring a sidecar container to bypass existing security policies. This allows the user to enable and execute untrusted remote code, leading to arbitrary code execution within the cluster.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Red Hat Red Hat OpenShift AI 2.25

Default version status: affected

  • 1785187119 to < *unaffected

Red Hat Red Hat OpenShift AI 3.3

Default version status: affected

  • 1785187521 to < *unaffected

Red Hat Red Hat OpenShift AI 3.4

Default version status: affected

  • 1784993206 to < *unaffected

Red Hat Red Hat OpenShift AI 3.4

Default version status: affected

  • 1786614608 to < *unaffected

Red Hat Red Hat OpenShift AI 3.5

Default version status: affected

  • 1786552271 to < *unaffected

Red Hat Red Hat OpenShift AI 3.5

Default version status: affected

  • 1786552250 to < *unaffected

References