CVE-2026-15467

8.1 highEPSS 0.6%

High (8.1). EPSS 0.6% chance of exploitation in the next 30 days.

A flaw was found in the trustyai-service-operator's LMEvalJob controller. An authenticated user within the cluster can exploit this vulnerability by configuring a sidecar container to bypass existing security policies. This allows the user to enable and execute untrusted remote code, leading to arbitrary code execution within the cluster.

Severity

CVSS 3.1

8.1 high

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

EPSS: 0.6% chance of exploitation in the next 30 days; higher than 48% of CVEs (scores of 2026-10-31)
CWE: CWE-266
Published: 2026-08-10
Modified: 2026-09-21
Record from: the NVD, synced 2026-10-19

References

https://access.redhat.com/errata/RHSA-2026:53261
https://access.redhat.com/errata/RHSA-2026:53262
https://access.redhat.com/errata/RHSA-2026:53263
https://access.redhat.com/errata/RHSA-2026:60367
https://access.redhat.com/errata/RHSA-2026:60520

Check your stack JSON