Odh-training-operator-rhel9: [trainer v2 security] trn-02: rhoai overlay aggregates trainjobs crud into standard edit clusterrole
A flaw was found in the Red Hat OpenShift AI (RHOAI) overlay for the training operator. The RHOAI overlay incorrectly aggregates `trainjobs` management permissions into the native Kubernetes `edit ClusterRole`. This allows any user with `edit ClusterRole` permissions in a namespace to create, modify, and delete `TrainJobs`. When combined with a separate vulnerability (TRN-01) that permits arbitrary pod configurations, a remote attacker with namespace editor privileges could exploit this to escalate privileges, potentially leading to arbitrary code execution.
Scoped product and version facts
Fix information unknown; no fixed version is derived here. Missing information does not prove that no fix exists.
Exploitation unknown; this catalogue does not assess exploitation.
Red Hat OpenShift AI 3.3
Vendor
Red Hat
Product
Red Hat OpenShift AI 3.3
Platforms
Unknown
Default status
affected
Package
rhoai/odh-training-operator-rhel9
Package collection
https://catalog.redhat.com/software/containers/
Red Hat OpenShift AI 3.3 · Scoped product and version facts
Version (version)
Status (status)
Version scheme (versionType)
Exclusive end (lessThan)
Inclusive end (lessThanOrEqual)
Status changes (at → status)
1785188461
unaffected
rpm
*
Unavailable
None listed
Red Hat OpenShift AI 3.3
Vendor
Red Hat
Product
Red Hat OpenShift AI 3.3
Platforms
Unknown
Default status
affected
Package
rhoai/odh-training-operator-rhel9
Package collection
https://catalog.redhat.com/software/containers/
Red Hat OpenShift AI 3.3 · Scoped product and version facts
Version (version)
Status (status)
Version scheme (versionType)
Exclusive end (lessThan)
Inclusive end (lessThanOrEqual)
Status changes (at → status)
1790137153
unaffected
rpm
*
Unavailable
None listed
Red Hat OpenShift AI 3.4
Vendor
Red Hat
Product
Red Hat OpenShift AI 3.4
Platforms
Unknown
Default status
affected
Package
rhoai/odh-training-operator-rhel9
Package collection
https://catalog.redhat.com/software/containers/
Red Hat OpenShift AI 3.4 · Scoped product and version facts
Version (version)
Status (status)
Version scheme (versionType)
Exclusive end (lessThan)
Inclusive end (lessThanOrEqual)
Status changes (at → status)
1784814352
unaffected
rpm
*
Unavailable
None listed
Red Hat OpenShift AI 3.4
Vendor
Red Hat
Product
Red Hat OpenShift AI 3.4
Platforms
Unknown
Default status
affected
Package
rhoai/odh-training-operator-rhel9
Package collection
https://catalog.redhat.com/software/containers/
Red Hat OpenShift AI 3.4 · Scoped product and version facts
Version (version)
Status (status)
Version scheme (versionType)
Exclusive end (lessThan)
Inclusive end (lessThanOrEqual)
Status changes (at → status)
1787361677
unaffected
rpm
*
Unavailable
None listed
Red Hat OpenShift AI 3.5
Vendor
Red Hat
Product
Red Hat OpenShift AI 3.5
Platforms
Unknown
Default status
affected
Package
rhoai/odh-latency-predictor-prediction-rhel9
Package collection
https://catalog.redhat.com/software/containers/
Red Hat OpenShift AI 3.5 · Scoped product and version facts
Version (version)
Status (status)
Version scheme (versionType)
Exclusive end (lessThan)
Inclusive end (lessThanOrEqual)
Status changes (at → status)
1786552271
unaffected
rpm
*
Unavailable
None listed
Red Hat OpenShift AI 3.5
Vendor
Red Hat
Product
Red Hat OpenShift AI 3.5
Platforms
Unknown
Default status
affected
Package
rhoai/odh-latency-predictor-training-rhel9
Package collection
https://catalog.redhat.com/software/containers/
Red Hat OpenShift AI 3.5 · Scoped product and version facts