CVE-2026-15063
Trustyai-service-operator: trustyai service operator: gorch port bypass when auth is enabled
- State
- Published
- Severity
- 6.3 Medium
- Published
- Jul 8, 2026
- Updated
- Aug 31, 2026
- Reserved
- Jul 8, 2026
Description
A flaw was found in the gorch service template, which is part of the trustyai-service-operator. Even when authentication is enabled, the gorch service exposes unproxied orchestrator and detector metrics ports. This allows any pod on the cluster network to directly access these ports, bypassing the kube-rbac-proxy and its authentication mechanisms. This could lead to unauthorized access to the orchestrator and detector metrics.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 3.1 | 6.3 Medium | CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N | redhat |
Weaknesses
- CWE-306 Missing Authentication for Critical Function
Affected Products
| Product | Versions |
|---|---|
trustyai-service-operatortrustyai-explainability |
|
Red Hat OpenShift AI (RHOAI)Red Hat |
References
- https://access.redhat.com/security/cve/CVE-2026-15063vdb-entry
- RHBZ#2498058issue-tracking
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.