Description
The RHOAI fork aggregates PyTorchJob, TFJob, MPIJob, XGBoostJob, and PaddleJob CRUD permissions onto the native Kubernetes edit and admin ClusterRoles via aggregate label selectors. This means any user with the standard edit or admin role in any namespace can create training jobs.

Combined with the unrestricted PodTemplateSpec passthrough (TO-03 / RHOAIENG-69160), this aggregation expands the attack surface from "users with explicit training job RBAC" to "every namespace editor." Any namespace editor can:

Create training jobs that impersonate arbitrary ServiceAccounts in the namespace

Mount hostPath volumes to access the host filesystem

Set privileged security contexts

Add arbitrary tolerations to bypass node isolation

Use pods/exec via the operator's ClusterRole (TO-02) for remote code execution

This is a fork-introduced change — upstream Kubeflow does not aggregate training job permissions onto standard ClusterRoles.

Equivalent finding in Trainer v2: TRN-02 (RHOAIENG-69139) — RHOAI overlay aggregates trainjobs CRUD into standard edit ClusterRole.

Impact
Every namespace editor in a cluster with training-operator installed can escalate privileges via training job creation, regardless of whether they were intended to have training workload access.

Recommendation
Remove aggregate label selectors from training job ClusterRoles. Require explicit RBAC grants for training job creation.

Audit Reference
Audit: HCMSEC-3528

Repository: red-hat-data-services/training-operator

Audit report