CVE-2026-15467CWE-266

CVE-2026-15467

High · published August 11, 2026

CVSS v3.1
8.1
EPSS
1%
Percentile
47.9
In the wild
Unconfirmed
What it is

A flaw was found in the trustyai-service-operator's LMEvalJob controller. An authenticated user within the cluster can exploit this vulnerability by configuring a sidecar container to bypass existing security policies. This allows the user to enable and execute untrusted remote code, leading to arbitrary code execution within the cluster.

The record
Technical detail
CVSS v3.1
8.1 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
CVSS v4.0
Not supplied
EPSS
0.00597 · 47.9th percentile
Weakness
CWE-266 · Incorrect Privilege Assignment
Published
2026-08-11T01:17Z
References (7)
https://access.redhat.com/errata/RHSA-2026:53261 · [email protected]https://access.redhat.com/errata/RHSA-2026:53262 · [email protected]https://access.redhat.com/errata/RHSA-2026:53263 · [email protected]https://access.redhat.com/errata/RHSA-2026:60367 · [email protected]https://access.redhat.com/errata/RHSA-2026:60520 · [email protected]https://access.redhat.com/security/cve/CVE-2026-15467 · [email protected]https://bugzilla.redhat.com/show_bug.cgi?id=2499086 · [email protected]
EPSS history
Timeline
  • 10 AUG 20:44Z
    Trustyai-service-operator: trustyai-service-operator: lmevaljob sidecar containers bypass protected environment variable filtering, allowing trust_remote_code policy override
    cvelistv5