A flaw was found in the RHOAI training-operator. This vulnerability allows a user with standard edit or admin roles in any Kubernetes namespace to escalate their privileges. Through the creation of training jobs, an attacker can impersonate service accounts, access the host filesystem, and potentially execute arbitrary code remotely. This issue arises from the aggregation of training job permissions onto native Kubernetes edit and admin ClusterRoles, coupled with unrestricted PodTemplateSpec passthrough.
Scoped product and version facts
Fix information unknown; no fixed version is derived here. Missing information does not prove that no fix exists.
Exploitation unknown; this catalogue does not assess exploitation.
Red Hat OpenShift AI 2.25
Vendor
Red Hat
Product
Red Hat OpenShift AI 2.25
Platforms
Unknown
Default status
affected
Package
rhoai/odh-training-operator-rhel9
Package collection
https://catalog.redhat.com/software/containers/
Red Hat OpenShift AI 2.25 · Scoped product and version facts
Version (version)
Status (status)
Version scheme (versionType)
Exclusive end (lessThan)
Inclusive end (lessThanOrEqual)
Status changes (at → status)
1785187053
unaffected
rpm
*
Unavailable
None listed
Red Hat OpenShift AI 3.3
Vendor
Red Hat
Product
Red Hat OpenShift AI 3.3
Platforms
Unknown
Default status
affected
Package
rhoai/odh-training-operator-rhel9
Package collection
https://catalog.redhat.com/software/containers/
Red Hat OpenShift AI 3.3 · Scoped product and version facts
Version (version)
Status (status)
Version scheme (versionType)
Exclusive end (lessThan)
Inclusive end (lessThanOrEqual)
Status changes (at → status)
1785188461
unaffected
rpm
*
Unavailable
None listed
Red Hat OpenShift AI 3.4
Vendor
Red Hat
Product
Red Hat OpenShift AI 3.4
Platforms
Unknown
Default status
affected
Package
rhoai/odh-training-operator-rhel9
Package collection
https://catalog.redhat.com/software/containers/
Red Hat OpenShift AI 3.4 · Scoped product and version facts
Version (version)
Status (status)
Version scheme (versionType)
Exclusive end (lessThan)
Inclusive end (lessThanOrEqual)
Status changes (at → status)
1784814352
unaffected
rpm
*
Unavailable
None listed
Red Hat OpenShift AI 3.4
Vendor
Red Hat
Product
Red Hat OpenShift AI 3.4
Platforms
Unknown
Default status
affected
Package
rhoai/odh-training-operator-rhel9
Package collection
https://catalog.redhat.com/software/containers/
Red Hat OpenShift AI 3.4 · Scoped product and version facts
Version (version)
Status (status)
Version scheme (versionType)
Exclusive end (lessThan)
Inclusive end (lessThanOrEqual)
Status changes (at → status)
1787361677
unaffected
rpm
*
Unavailable
None listed
Red Hat OpenShift AI 3.5
Vendor
Red Hat
Product
Red Hat OpenShift AI 3.5
Platforms
Unknown
Default status
affected
Package
rhoai/odh-latency-predictor-prediction-rhel9
Package collection
https://catalog.redhat.com/software/containers/
Red Hat OpenShift AI 3.5 · Scoped product and version facts
Version (version)
Status (status)
Version scheme (versionType)
Exclusive end (lessThan)
Inclusive end (lessThanOrEqual)
Status changes (at → status)
1786552271
unaffected
rpm
*
Unavailable
None listed
Red Hat OpenShift AI 3.5
Vendor
Red Hat
Product
Red Hat OpenShift AI 3.5
Platforms
Unknown
Default status
affected
Package
rhoai/odh-latency-predictor-training-rhel9
Package collection
https://catalog.redhat.com/software/containers/
Red Hat OpenShift AI 3.5 · Scoped product and version facts