CVE-2026-15467: TrustyAI Service Operator RCE Vulnerability

CVE-2026-15467 Overview

CVE-2026-15467 affects the trustyai-service-operator LMEvalJob controller. An authenticated cluster user can configure a sidecar container to bypass security policies enforced by the operator. This bypass enables execution of untrusted remote code inside the cluster, resulting in arbitrary code execution within the workload context.

The flaw is classified under [CWE-266] Incorrect Privilege Assignment. Red Hat has issued security advisories addressing the affected components in its OpenShift AI product line.

Critical Impact
Authenticated users can escape LMEvalJob controller policy controls, load untrusted sidecar containers, and execute arbitrary code within the Kubernetes cluster.

Affected Products

Red Hat OpenShift AI components using the trustyai-service-operator
LMEvalJob controller in TrustyAI Service Operator
Kubernetes clusters running affected TrustyAI operator versions

Discovery Timeline

2026-08-10 - CVE-2026-15467 published to NVD
2026-08-12 - Last updated in NVD database

Technical Details for CVE-2026-15467

Vulnerability Analysis

The trustyai-service-operator provides the LMEvalJob custom resource to run language model evaluations inside a cluster. The operator's controller reconciles LMEvalJob specs and launches pods to execute the evaluation workload.

The LMEvalJob controller applies security policies to the primary evaluation container. It does not enforce equivalent restrictions on sidecar containers declared in the job spec. An authenticated user with permission to create LMEvalJob resources can attach a sidecar that pulls an untrusted image or executes attacker-controlled code.

Because the sidecar runs inside the same pod, it shares the network namespace and can interact with service account tokens mounted into the pod. This grants the attacker code execution with the identity and privileges of the LMEvalJob workload.

Root Cause

The root cause is incorrect privilege assignment [CWE-266] in the LMEvalJob controller. Policy enforcement covers only the primary container spec. Sidecar containers pass through the admission path without the same guardrails, breaking the operator's trust boundary.

Attack Vector

Exploitation requires network access to the Kubernetes API and low-privilege authenticated credentials that permit LMEvalJob creation. The attacker submits an LMEvalJob manifest containing a malicious sidecar container definition. When the controller reconciles the object, the sidecar launches and executes untrusted code inside the cluster. See the Red Hat CVE Analysis for CVE-2026-15467 for vendor technical details.

Detection Methods for CVE-2026-15467

Indicators of Compromise

LMEvalJob custom resources containing sidecarContainers or additional container specs referencing external or unapproved image registries.
Pods created by the trustyai-service-operator running more containers than the expected single evaluation container.
Outbound network connections from LMEvalJob pods to unexpected destinations, including image registries and command-and-control endpoints.

Detection Strategies

Audit Kubernetes API server logs for create and update events on the LMEvalJob resource, focusing on manifests that declare sidecar containers.
Compare running pod specs against approved LMEvalJob templates to identify unauthorized container images.
Alert when service account tokens issued to LMEvalJob pods are used from unexpected source IPs or namespaces.

Monitoring Recommendations

Ingest Kubernetes audit logs and container runtime telemetry into a centralized analytics pipeline for correlation.
Monitor image pulls in LMEvalJob namespaces and flag any registry not on an allowlist.
Track process execution and outbound network activity inside LMEvalJob pods to identify post-exploitation behavior.

How to Mitigate CVE-2026-15467

Immediate Actions Required

Apply the fixed trustyai-service-operator builds distributed through RHSA-2026:53261, RHSA-2026:53262, and RHSA-2026:53263.
Restrict RBAC permissions so only trusted service accounts can create or modify LMEvalJob resources.
Review existing LMEvalJob objects for unexpected sidecar container definitions and delete any unauthorized instances.

Patch Information

Red Hat published fixes in the security advisories RHSA-2026:53261, RHSA-2026:53262, and RHSA-2026:53263. Additional context is available in the Red Hat Bug Report #2499086 and the Red Hat CVE Analysis for CVE-2026-15467.

Workarounds

Deploy an admission policy, such as Kyverno or Gatekeeper, that rejects LMEvalJob objects containing sidecar containers or images from untrusted registries.
Constrain LMEvalJob pods with a restrictive PodSecurity profile and NetworkPolicies that block egress to unapproved destinations.
Rotate service account tokens associated with the trustyai-service-operator namespace after applying the patch to invalidate any credentials exposed during exposure windows.

bash

# Configuration example: block LMEvalJob objects that declare sidecar containers
# Kyverno ClusterPolicy (illustrative)
apiVersion: kyverno.io/v1
kind: ClusterPolicy
metadata:
  name: block-lmevaljob-sidecars
spec:
  validationFailureAction: Enforce
  rules:
    - name: deny-extra-containers
      match:
        any:
          - resources:
              kinds:
                - trustyai.opendatahub.io/LMEvalJob
      validate:
        message: "Sidecar containers are not permitted in LMEvalJob resources."
        pattern:
          spec:
            =(sidecarContainers): "[]"