High severity · published Aug 10, 2026
CVE-2026-18951
Odh-training-operator-rhel9: [trainer v2 security] trn-02: rhoai overlay aggregates trainjobs crud into standard edit clusterrole
8.8
CVSS
0.9%
EPSS
No
On KEV
Description
A flaw was found in the Red Hat OpenShift AI (RHOAI) overlay for the training operator. The RHOAI overlay incorrectly aggregates `trainjobs` management permissions into the native Kubernetes `edit ClusterRole`. This allows any user with `edit ClusterRole` permissions in a namespace to create, modify, and delete `TrainJobs`. When combined with a separate vulnerability (TRN-01) that permits arbitrary pod configurations, a remote attacker with namespace editor privileges could exploit this to escalate privileges, potentially leading to arbitrary code execution.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.9% · higher than 60% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
RH
Red Hat OpenShift AI 3.3 · Red Hat
All versions, or not specified · source: vendor
RH
Red Hat OpenShift AI 3.4 · Red Hat
All versions, or not specified · source: vendor
RH
Red Hat OpenShift AI 3.5 · Red Hat
All versions, or not specified · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-18951
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-18951
vendor-advisory
https://access.redhat.com/errata/RHSA-2026:53262
vendor-advisory
https://access.redhat.com/errata/RHSA-2026:53263
vendor-advisory
https://access.redhat.com/errata/RHSA-2026:60367
vendor-advisory
https://access.redhat.com/errata/RHSA-2026:60520
vendor-advisory
https://access.redhat.com/errata/RHSA-2026:73987
vdb-entry
https://access.redhat.com/security/cve/CVE-2026-18951
More from Red Hat OpenShift AI 3.3
8.8
CVE-2026-42271
LiteLLM: Authenticated command execution via MCP stdio test endpoints
6.5
CVE-2026-48710
Starlette has missing Host header validation that poisons request.url.path, bypassing path-based security checks
10.0
CVE-2026-46595
Invoking VerifiedPublicKeyCallback permissions skip enforcement in golang.org/x/crypto/ssh
9.9
CVE-2026-18948
Feast: feast: unsafe dill deserialization of registry-stored udfs — rce on feature server and registry server
9.9
CVE-2026-5483
Odh-dashboard: odh dashboard kubernetes service account exposure