HIGHVulnerability
Verified
Global

NVD HIGH: CVE-2026-18951 — A flaw was found in the Red Hat OpenShift AI (RHOAI) overlay for the training op...

·Source: NIST NVD

Updated:

Executive Summary

A flaw was found in the Red Hat OpenShift AI (RHOAI) overlay for the training operator. The RHOAI overlay incorrectly aggregates `trainjobs` management permissions into the native Kubernetes `edit ClusterRole`. This allows any user with `edit ClusterRole` permissions in a namespace to create, modify, and delete `TrainJobs`. When combined with a separate vulnerability (TRN-01) that permits arbitrar

Analysis

A flaw was found in the Red Hat OpenShift AI (RHOAI) overlay for the training operator. The RHOAI overlay incorrectly aggregates `trainjobs` management permissions into the native Kubernetes `edit ClusterRole`. This allows any user with `edit ClusterRole` permissions in a namespace to create, modify, and delete `TrainJobs`. When combined with a separate vulnerability (TRN-01) that permits arbitrary pod configurations, a remote attacker with namespace editor privileges could exploit this to escalate privileges, potentially leading to arbitrary code execution. CVSS Score: 8.8. Published: 2026-08-10T21:17:21.710.

Indicators of Compromise (1)

CVE (1)
CVE-2026-18951
NVDMITRE CVE
Source Attribution

Originally published by NIST NVD on Aug 10, 2026. Verified by: NIST.

Related Threats

MEDIUMVulnerability

Apple sends new ‘Threat Notification’ alerts over mercenary spyware attacks

You're not alone if you just received an "Apple Threat Notification" saying it detected a "mercenary spyware attack targeted at your iPhone." [...]

BleepingComputer
MEDIUMVulnerabilityPOC

MUFG trials blockchain settlement for Japanese Government Bond repo trades

Mitsubishi UFJ Financial Group (MUFG) is running a proof-of-concept for bringing Japanese Government Bond repo transactions on-chain using the Canton Network blockchain.

Finextra
MEDIUMVulnerability

BofA to buy 49.9% stake in Indian digital lender Jio Credit

Bank of America has struck a $1.9 billion deal to buy up to 49.9% of Indian digital-native non-bank lender Jio Credit.

Finextra