CVE-2026-18951

Name of the Vulnerable Software and Affected Versions Red Hat OpenShift AI (RHOAI) (affected versions not specified)

Description A flaw exists in the Red Hat OpenShift AI (RHOAI) overlay for the training operator. The overlay incorrectly aggregates management permissions for trainjobs into the native Kubernetes edit ClusterRole. This allows users with edit ClusterRole permissions within a namespace to create, modify, and delete TrainJobs. If combined with another issue allowing arbitrary pod configurations, a remote attacker with namespace editor privileges could escalate privileges, potentially resulting in arbitrary code execution.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.