Bug 2511648 (CVE-2026-18982)

Summary: CVE-2026-18982 odh-training-operator-rhel9: RHOAI fork aggregates training job create onto native edit/admin ClusterRoles
Product: [Other] Security Response Reporter: OSIDB Bzimport <bzimport>
Component: vulnerabilityAssignee: Product Security <prodsec-ir-bot>
Status: NEW --- QA Contact:
Severity: urgent Docs Contact:
Priority: urgent    
Version: unspecifiedCC: security-response-team
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: ---
Doc Text:
A flaw was found in the RHOAI training-operator. This vulnerability allows a user with standard edit or admin roles in any Kubernetes namespace to escalate their privileges. Through the creation of training jobs, an attacker can impersonate service accounts, access the host filesystem, and potentially execute arbitrary code remotely. This issue arises from the aggregation of training job permissions onto native Kubernetes edit and admin ClusterRoles, coupled with unrestricted PodTemplateSpec passthrough.
 Story Points: ---
Clone Of: Environment:
Last Closed: Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:

Description OSIDB Bzimport 2026-08-05 16:59:03 UTC 
Description
The RHOAI fork aggregates PyTorchJob, TFJob, MPIJob, XGBoostJob, and PaddleJob CRUD permissions onto the native Kubernetes edit and admin ClusterRoles via aggregate label selectors. This means any user with the standard edit or admin role in any namespace can create training jobs.

Combined with the unrestricted PodTemplateSpec passthrough (TO-03 / RHOAIENG-69160), this aggregation expands the attack surface from "users with explicit training job RBAC" to "every namespace editor." Any namespace editor can:

Create training jobs that impersonate arbitrary ServiceAccounts in the namespace

Mount hostPath volumes to access the host filesystem

Set privileged security contexts

Add arbitrary tolerations to bypass node isolation

Use pods/exec via the operator's ClusterRole (TO-02) for remote code execution

This is a fork-introduced change — upstream Kubeflow does not aggregate training job permissions onto standard ClusterRoles.

Equivalent finding in Trainer v2: TRN-02 (RHOAIENG-69139) — RHOAI overlay aggregates trainjobs CRUD into standard edit ClusterRole.

Impact
Every namespace editor in a cluster with training-operator installed can escalate privileges via training job creation, regardless of whether they were intended to have training workload access.

Recommendation
Remove aggregate label selectors from training job ClusterRoles. Require explicit RBAC grants for training job creation.

Audit Reference
Audit: HCMSEC-3528

Repository: red-hat-data-services/training-operator

Audit report