CVE-2026-18982

Name of the Vulnerable Software and Affected Versions RHOAI training-operator (affected versions not specified)

Description A flaw allows users with standard edit or admin roles in any Kubernetes namespace to escalate privileges. By creating training jobs, an attacker can impersonate service accounts, access the host filesystem, and potentially execute arbitrary code remotely. This occurs because training job permissions are aggregated into native Kubernetes edit and admin ClusterRoles, combined with unrestricted PodTemplateSpec passthrough.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.