Skip to content
OpenAdvisories
High · 8.1 CVE-2026-15467 EUVD-2026-55809GHSA-qw34-v3jw-3crv

Trustyai-service-operator: trustyai-service-operator: lmevaljob sidecar containers bypass protected environment variable filtering, allowing trust_remote_code policy override

Published Aug 10, 2026 · Updated Sep 21, 2026 · Assigned by redhat

Description

A flaw was found in the trustyai-service-operator's LMEvalJob controller. An authenticated user within the cluster can exploit this vulnerability by configuring a sidecar container to bypass existing security policies. This allows the user to enable and execute untrusted remote code, leading to arbitrary code execution within the cluster.

Affected products

VendorProductAffectedFixed
Red Hat Red Hat OpenShift AI 2.25 — —
Red Hat Red Hat OpenShift AI 3.3 — —
Red Hat Red Hat OpenShift AI 3.4 — —
Red Hat Red Hat OpenShift AI 3.5 — —

Advisories 1

References