Privilege Escalation Vulnerability in Trainer v2 by Red Hat
CVE-2026-83495

Currently unrated

Key Information:

Vendor

Red Hat
Status
Red Hat Openshift Ai (rhoai)
Vendor
CVE Published:
7 November 2026

What is CVE-2026-83495?

A security flaw in the Trainer v2 TrainJob API permits users with the capability to create TrainJobs to potentially manipulate environment variable definitions by injecting valueFrom.secretKeyRef. This exploitation can lead to unauthorized access and exfiltration of sensitive information such as secrets from the namespace. The issue is exacerbated when the role-based access control (RBAC) settings for TrainJob are less restrictive than those for accessing the secrets, thereby allowing for this escalation of privileges.

References

https://access.redhat.com/security/cve/CVE-2026-83495
vdb-entryx_refsource_REDHAT
https://bugzilla.redhat.com/show_bug.cgi?id=2526350
issue-trackingx_refsource_REDHAT

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.