CVE-2026-18982

Received Received - Intake

Privilege Escalation in RHOAI Training Operator

Publication date: 2026-08-10

Last updated on: 2026-08-10

Assigner: Red Hat, Inc.

Description

A flaw was found in the RHOAI training-operator. This vulnerability allows a user with standard edit or admin roles in any Kubernetes namespace to escalate their privileges. Through the creation of training jobs, an attacker can impersonate service accounts, access the host filesystem, and potentially execute arbitrary code remotely. This issue arises from the aggregation of training job permissions onto native Kubernetes edit and admin ClusterRoles, coupled with unrestricted PodTemplateSpec passthrough.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-10

Last Modified

2026-08-10

Generated

2026-08-11

AI Q&A

2026-08-11

EPSS Evaluated

N/A

NVD

CVE-2026-18982

Affected Vendors & Products

Vendor	Product	Version / Range
redhat	rhoai_training-operator	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-250	The product performs an operation at a privilege level that is higher than the minimum level required, which creates new weaknesses or amplifies the consequences of other weaknesses.

Attack-Flow Graph

Executive Summary

This vulnerability in the RHOAI training-operator allows users with standard edit or admin roles in any Kubernetes namespace to escalate their privileges. Attackers can create training jobs to impersonate service accounts, access the host filesystem, and potentially execute arbitrary code remotely. The issue stems from aggregated training job permissions being added to native Kubernetes edit and admin ClusterRoles, combined with unrestricted PodTemplateSpec passthrough.

Impact Analysis

If you are a user with edit or admin roles in a Kubernetes namespace, an attacker could exploit this to gain higher privileges, access sensitive data, or run malicious code on your systems. This could lead to data breaches, unauthorized modifications, or system compromise.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating GDPR and HIPAA requirements for data protection and access controls. Organizations may face compliance violations, legal penalties, and reputational damage if exploited.

Mitigation Strategies

Immediately restrict PodTemplateSpec passthrough in training jobs. Review and limit permissions for users with edit or admin roles in Kubernetes namespaces. Monitor for unauthorized training job creation or service account impersonation attempts.

Hi! I’m here to help you understand CVE-2026-18982. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70