CVE-2026-15467

Published: Aug 10, 2026Modified: Aug 27, 2026

8.1

Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

Exploitability: 2.8 / Impact: 5.2

Source: secalert@redhat.com (Secondary)

Description

A flaw was found in the trustyai-service-operator's LMEvalJob controller. An authenticated user within the cluster can exploit this vulnerability by configuring a sidecar container to bypass existing security policies. This allows the user to enable and execute untrusted remote code, leading to arbitrary code execution within the cluster.

Related CWEs

Incorrect Privilege Assignment

A product incorrectly assigns a privilege to a particular actor, creating an unintended sphere of control for that actor.

References (6)

https://access.redhat.com/errata/RHSA-2026:53261

Source: secalert@redhat.com

https://access.redhat.com/errata/RHSA-2026:53262

Source: secalert@redhat.com

https://access.redhat.com/errata/RHSA-2026:53263

Source: secalert@redhat.com

https://access.redhat.com/errata/RHSA-2026:60520

Source: secalert@redhat.com

https://access.redhat.com/security/cve/CVE-2026-15467

Source: secalert@redhat.com

https://bugzilla.redhat.com/show_bug.cgi?id=2499086

Source: secalert@redhat.com

Timeline

No history available yet.