CVE-2026-15467

Received Received - Intake

Remote Code Execution in TrustyAI Service Operator

Publication date: 2026-08-10

Last updated on: 2026-08-10

Assigner: Red Hat, Inc.

Description

A flaw was found in the trustyai-service-operator's LMEvalJob controller. An authenticated user within the cluster can exploit this vulnerability by configuring a sidecar container to bypass existing security policies. This allows the user to enable and execute untrusted remote code, leading to arbitrary code execution within the cluster.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-10

Last Modified

2026-08-10

Generated

2026-08-11

AI Q&A

2026-08-11

EPSS Evaluated

N/A

NVD

CVE-2026-15467

Affected Vendors & Products

Vendor	Product	Version / Range
redhat	trustyai-service-operator	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-266	A product incorrectly assigns a privilege to a particular actor, creating an unintended sphere of control for that actor.

Attack-Flow Graph

Executive Summary

This vulnerability is in the trustyai-service-operator's LMEvalJob controller. An authenticated user inside the cluster can bypass security policies by setting up a sidecar container. This lets them run untrusted remote code, which can lead to arbitrary code execution within the cluster.

Impact Analysis

If exploited, this flaw allows attackers to execute arbitrary code in your cluster. This could lead to unauthorized access, data breaches, or disruption of services. The impact depends on the cluster's configuration and the permissions of the compromised user.

Compliance Impact

This vulnerability could lead to unauthorized code execution, potentially causing data breaches or loss of sensitive information. Such incidents may violate compliance requirements like GDPR or HIPAA, depending on the data involved and the organization's policies.

Mitigation Strategies

Review and restrict sidecar container configurations in the trustyai-service-operator's LMEvalJob controller. Ensure only trusted users have cluster access and enforce strict security policies to prevent unauthorized remote code execution.

Hi! I’m here to help you understand CVE-2026-15467. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70