CyberRota Analysis
AI-GeneratedA vulnerability in the Red Hat OpenShift AI overlay for the training operator allows users with `edit ClusterRole` permissions in Kubernetes namespaces to manipulate `TrainJobs`, including their creation, modification, and deletion. This flaw, when exploited alongside another vulnerability that enables arbitrary pod configurations, could allow a remote attacker to escalate privileges and execute arbitrary code. Organizations using Kubernetes, particularly those leveraging OpenShift AI, should prioritize remediation to mitigate the risk of unauthorized access and potential code execution.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
A flaw was found in the Red Hat OpenShift AI (RHOAI) overlay for the training operator. The RHOAI overlay incorrectly aggregates `trainjobs` management permissions into the native Kubernetes `edit ClusterRole`. This allows any user with `edit ClusterRole` permissions in a namespace to create, modify, and delete `TrainJobs`. When combined with a separate vulnerability (TRN-01) that permits arbitrary pod configurations, a remote attacker with namespace editor privileges could exploit this to escalate privileges, potentially leading to arbitrary code execution.