Privilege Escalation Vulnerability in RHOAI Training-Operator from Red Hat

CVE-2026-18982

What is CVE-2026-18982?

A vulnerability exists in the RHOAI training-operator that allows users with standard edit or admin roles to escalate their privileges within any Kubernetes namespace. Attackers can exploit this flaw by creating training jobs, enabling them to impersonate service accounts and access the host filesystem. This could lead to the execution of arbitrary code remotely. The issue stems from the aggregation of permissions granted to training jobs and unrestricted access to PodTemplateSpec passthrough, enabling potential exploitation.

References