Trustyai-service-operator: trustyai-service-operator: tas internal service bypasses kube-rbac-proxy, exposing unauthenticated quarkus api cluster-wide (Red Hat Red Hat OpenShift AI 2.25)
En bref
- Source
- NVD
- EPSS
- EPSS 0.42 % · centile 36 ()
- État
- PUBLISHED
- Publiée
- Mise à jour
- Attribuée par
- redhat
- Statut NVD
- Awaiting Analysis
Rechercher sur…
Description
A flaw was found in the TrustyAI Service (TAS) deployment. This vulnerability allows any pod on the cluster network to bypass authentication and directly access the TAS backend API. An attacker can exploit this to read, tamper with, or delete monitoring data and configurations, and inject arbitrary data into the service, potentially disrupting tenant operations.
Faiblesses (CWE)
- CWE-306 — Authentification absente sur une fonction critique
Références
- https://access.redhat.com/errata/RHSA-2026:53261
- https://access.redhat.com/errata/RHSA-2026:53262
- https://access.redhat.com/errata/RHSA-2026:53263
- https://access.redhat.com/errata/RHSA-2026:60367
- https://access.redhat.com/errata/RHSA-2026:60520
- https://access.redhat.com/errata/RHSA-2026:65126
- https://access.redhat.com/security/cve/CVE-2026-15581
- https://bugzilla.redhat.com/show_bug.cgi?id=2499637
Scores
| Version | Score | Vecteur | Évalué par |
|---|---|---|---|
| CVSS 3.1 | HIGH 8.0 | CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H | redhat |
| CVSS 3.1 | HIGH 8.0 | CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H | NVD · secalert@redhat.com (Secondary) |
Références européennes
- ENISA EUVD · EUVD-2026-55810
- GCVE · GCVE-0-2026-15581
Produits affectés
| Produit | Versions |
|---|---|
| Red Hat · Red Hat OpenShift AI 2.25 | unaffected 1785187119 < * |
| Red Hat · Red Hat OpenShift AI 2.25 | unaffected 1787330073 < * |
| Red Hat · Red Hat OpenShift AI 3.3 | unaffected 1785187521 < * |
| Red Hat · Red Hat OpenShift AI 3.4 | unaffected 1784993206 < * |
| Red Hat · Red Hat OpenShift AI 3.4 | unaffected 1786614608 < * |
| Red Hat · Red Hat OpenShift AI 3.5 | unaffected 1786552271 < * |
| Red Hat · Red Hat OpenShift AI 3.5 | unaffected 1786552250 < * |
Sources
| Source | Licence |
|---|---|
| CVE List (CVEProject cvelistV5) | CVE Program Terms of Use |
| EPSS (FIRST.org) | FIRST — attribution requested |
| ENISA EUVD | ENISA — reproduction authorised, source acknowledged |
| NVD (NIST) via fkie-cad/nvd-json-data-feeds | Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD |