CVE-2026-18951: Red Hat OpenShift AI Privilege Escalation

CVE-2026-18951 Overview

CVE-2026-18951 is an improper access control vulnerability [CWE-284] in the Red Hat OpenShift AI (RHOAI) overlay for the training operator. The overlay incorrectly aggregates trainjobs management permissions into the native Kubernetes edit ClusterRole. Any user holding edit ClusterRole permissions in a namespace can create, modify, and delete TrainJobs objects. When chained with a separate flaw (TRN-01) that permits arbitrary pod configurations, a remote attacker with namespace editor privileges can escalate privileges and potentially execute arbitrary code.

Critical Impact
Namespace-scoped editor users can abuse aggregated TrainJobs permissions to escalate privileges within the cluster and, when combined with TRN-01, achieve arbitrary code execution.

Affected Products

Red Hat OpenShift AI (RHOAI) — training operator overlay
See Red Hat Security Advisory RHSA-2026:53262
See Red Hat Security Advisory RHSA-2026:53263

Discovery Timeline

2026-08-10 - CVE-2026-18951 published to NVD
2026-08-12 - Last updated in NVD database

Technical Details for CVE-2026-18951

Vulnerability Analysis

The flaw resides in how the RHOAI overlay defines Kubernetes RBAC aggregation for the training operator. Kubernetes aggregates ClusterRoles by matching label selectors on rules. The RHOAI overlay attaches TrainJobs custom resource verbs (create, update, patch, delete) to rules that aggregate into the built-in edit ClusterRole. This effectively grants every namespace editor the ability to manage TrainJobs resources, which was not the intended authorization boundary.

TrainJobs are managed by the training operator, which reconciles them into pods running with operator-controlled service accounts. When combined with the referenced TRN-01 issue that permits arbitrary pod configurations in a TrainJob, an attacker can specify container images, commands, volume mounts, and security contexts. The training operator then schedules pods that inherit permissions beyond the attacker's original namespace scope, enabling privilege escalation and arbitrary code execution on the cluster.

Root Cause

The root cause is an overly broad RBAC aggregation label applied to the TrainJobs ClusterRole in the RHOAI overlay. Kubernetes automatically merges rules with the rbac.authorization.k8s.io/aggregate-to-edit: "true" label into the edit ClusterRole. Applying this label to a resource that should have required an operator-controlled role broke the principle of least privilege.

Attack Vector

Exploitation requires network access to the Kubernetes API server and low-privileged authenticated credentials with the edit role in any namespace. The attacker submits a crafted TrainJob manifest referencing an attacker-chosen pod spec. The training operator materializes the pod, executing the attacker payload with elevated privileges. No user interaction is required.

Vulnerability mechanism (prose description — no verified PoC available):
1. Attacker authenticates as a namespace editor.
2. Attacker submits a TrainJob custom resource with a malicious pod template (TRN-01).
3. The training operator reconciles the TrainJob into a pod using operator-scoped privileges.
4. The malicious container runs, achieving privilege escalation and code execution.

Detection Methods for CVE-2026-18951

Indicators of Compromise

Creation of TrainJobs custom resources by user accounts that are not part of the ML/data-science workflow.
TrainJob specifications referencing unusual container images, hostPath volumes, privileged: true, or hostNetwork: true.
Pods created by the training operator exhibiting outbound connections to unknown IP addresses or executing reconnaissance commands.

Detection Strategies

Audit Kubernetes API server logs for create, update, and patch verbs on the trainjobs.kubeflow.org (or equivalent) resource by non-privileged identities.
Compare RBAC bindings against the intended authorization matrix and flag users with edit role that also manipulate TrainJobs.
Correlate TrainJob creation events with pod-spawn events and inspect the resulting pod specs for privileged parameters.

Monitoring Recommendations

Forward Kubernetes audit logs to a centralized analytics platform and alert on anomalous TrainJob activity.
Baseline expected training-operator activity per namespace, then alert on deviations.
Monitor training-operator service account token usage for unexpected API calls.

How to Mitigate CVE-2026-18951

Immediate Actions Required

Apply the updates referenced in RHSA-2026:53262 and RHSA-2026:53263 to all affected RHOAI clusters.
Review users bound to the edit ClusterRole across namespaces and remove unnecessary grants.
Audit existing TrainJobs for suspicious pod specifications and remediate any malicious workloads.

Patch Information

Red Hat has released fixed builds of Red Hat OpenShift AI that remove the aggregation label from the TrainJobs RBAC rule. See the Red Hat CVE analysis for CVE-2026-18951 and Red Hat Bug Report #2511187 for the fixed component versions and errata scope.

Workarounds

Remove the rbac.authorization.k8s.io/aggregate-to-edit label from the RHOAI-provided TrainJobs ClusterRole until the patch is applied.
Restrict the edit ClusterRole in sensitive namespaces and issue narrower custom roles that exclude trainjobs verbs.
Enforce admission policies (Kyverno or Gatekeeper) that reject TrainJob pod specs containing privileged security contexts, hostPath mounts, or hostNetwork.

bash

# Example: remove edit-aggregation label from the TrainJobs ClusterRole
kubectl label clusterrole trainjobs-editor \
  rbac.authorization.k8s.io/aggregate-to-edit-

# Example: list users and groups bound to the edit ClusterRole cluster-wide
kubectl get rolebindings,clusterrolebindings --all-namespaces \
  -o jsonpath='{range .items[?(@.roleRef.name=="edit")]}{.metadata.namespace}{"\t"}{.metadata.name}{"\t"}{.subjects}{"\n"}{end}'