HIGH

CVE-2026-15467

2026-08-10 CVSS v3.1

CVSS

8.1

Description

A flaw was found in the trustyai-service-operator's LMEvalJob controller. An authenticated user within the cluster can exploit this vulnerability by configuring a sidecar container to bypass existing security policies. This allows the user to enable and execute untrusted remote code, leading to arbitrary code execution within the cluster.

Weakness (CWE)

CWE-266 Incorrect Privilege Assignment

EPSS Score

0.42%

Probability of exploitation in next 30 days

35.5th percentile

References

https://access.redhat.com/errata/RHSA-2026:53261 https://access.redhat.com/errata/RHSA-2026:53262 https://access.redhat.com/errata/RHSA-2026:53263 https://access.redhat.com/errata/RHSA-2026:60367 https://access.redhat.com/errata/RHSA-2026:60520 https://access.redhat.com/security/cve/CVE-2026-15467 https://bugzilla.redhat.com/show_bug.cgi?id=2499086

View on dbcve.org

Base CVE data derived from NVD (public domain). Enrichment by dbcve.org (CC-BY-4.0). Fetched via API.

Back to CVE