Trustyai-service-operator: trustyai-service-operator: tas internal service bypasses kube-rbac-proxy, exposing unauthenticated quarkus api cluster-wide
A flaw was found in the TrustyAI Service (TAS) deployment. This vulnerability allows any pod on the cluster network to bypass authentication and directly access the TAS backend API. An attacker can exploit this to read, tamper with, or delete monitoring data and configurations, and inject arbitrary data into the service, potentially disrupting tenant operations.
Scoped product and version facts
Fix information unknown; no fixed version is derived here. Missing information does not prove that no fix exists.
Exploitation unknown; this catalogue does not assess exploitation.
Red Hat OpenShift AI 2.25
Vendor
Red Hat
Product
Red Hat OpenShift AI 2.25
Platforms
Unknown
Default status
affected
Package
rhoai/odh-trustyai-service-operator-rhel9
Package collection
https://catalog.redhat.com/software/containers/
Red Hat OpenShift AI 2.25 · Scoped product and version facts
Version (version)
Status (status)
Version scheme (versionType)
Exclusive end (lessThan)
Inclusive end (lessThanOrEqual)
Status changes (at → status)
1785187119
unaffected
rpm
*
Unavailable
None listed
Red Hat OpenShift AI 2.25
Vendor
Red Hat
Product
Red Hat OpenShift AI 2.25
Platforms
Unknown
Default status
affected
Package
rhoai/odh-trustyai-service-operator-rhel9
Package collection
https://catalog.redhat.com/software/containers/
Red Hat OpenShift AI 2.25 · Scoped product and version facts
Version (version)
Status (status)
Version scheme (versionType)
Exclusive end (lessThan)
Inclusive end (lessThanOrEqual)
Status changes (at → status)
1787330073
unaffected
rpm
*
Unavailable
None listed
Red Hat OpenShift AI 3.3
Vendor
Red Hat
Product
Red Hat OpenShift AI 3.3
Platforms
Unknown
Default status
affected
Package
rhoai/odh-trustyai-service-operator-rhel9
Package collection
https://catalog.redhat.com/software/containers/
Red Hat OpenShift AI 3.3 · Scoped product and version facts
Version (version)
Status (status)
Version scheme (versionType)
Exclusive end (lessThan)
Inclusive end (lessThanOrEqual)
Status changes (at → status)
1785187521
unaffected
rpm
*
Unavailable
None listed
Red Hat OpenShift AI 3.4
Vendor
Red Hat
Product
Red Hat OpenShift AI 3.4
Platforms
Unknown
Default status
affected
Package
rhoai/odh-trustyai-service-operator-rhel9
Package collection
https://catalog.redhat.com/software/containers/
Red Hat OpenShift AI 3.4 · Scoped product and version facts
Version (version)
Status (status)
Version scheme (versionType)
Exclusive end (lessThan)
Inclusive end (lessThanOrEqual)
Status changes (at → status)
1784993206
unaffected
rpm
*
Unavailable
None listed
Red Hat OpenShift AI 3.4
Vendor
Red Hat
Product
Red Hat OpenShift AI 3.4
Platforms
Unknown
Default status
affected
Package
rhoai/odh-trustyai-service-operator-rhel9
Package collection
https://catalog.redhat.com/software/containers/
Red Hat OpenShift AI 3.4 · Scoped product and version facts
Version (version)
Status (status)
Version scheme (versionType)
Exclusive end (lessThan)
Inclusive end (lessThanOrEqual)
Status changes (at → status)
1786614608
unaffected
rpm
*
Unavailable
None listed
Red Hat OpenShift AI 3.5
Vendor
Red Hat
Product
Red Hat OpenShift AI 3.5
Platforms
Unknown
Default status
affected
Package
rhoai/odh-latency-predictor-prediction-rhel9
Package collection
https://catalog.redhat.com/software/containers/
Red Hat OpenShift AI 3.5 · Scoped product and version facts
Version (version)
Status (status)
Version scheme (versionType)
Exclusive end (lessThan)
Inclusive end (lessThanOrEqual)
Status changes (at → status)
1786552271
unaffected
rpm
*
Unavailable
None listed
Red Hat OpenShift AI 3.5
Vendor
Red Hat
Product
Red Hat OpenShift AI 3.5
Platforms
Unknown
Default status
affected
Package
rhoai/odh-latency-predictor-training-rhel9
Package collection
https://catalog.redhat.com/software/containers/
Red Hat OpenShift AI 3.5 · Scoped product and version facts