Riskcovery

CVE-2026-15581

Trustyai-service-operator: trustyai-service-operator: tas internal service bypasses kube-rbac-proxy, exposing unauthenticated quarkus api cluster-wide

State
Published
Severity
8.0 High
Published
Aug 10, 2026
Updated
Oct 12, 2026
Reserved
Jul 13, 2026

Read the record on cve.org

Description

A flaw was found in the TrustyAI Service (TAS) deployment. This vulnerability allows any pod on the cluster network to bypass authentication and directly access the TAS backend API. An attacker can exploit this to read, tamper with, or delete monitoring data and configurations, and inject arbitrary data into the service, potentially disrupting tenant operations.

Scores

CVSSScoreVectorSource
3.18.0 HighCVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:Hredhat

Weaknesses

  • CWE-306 Missing Authentication for Critical Function

Affected Products

ProductVersions
Red Hat OpenShift AI 2.25Red Hat
  • 1785187119 and laterNot affected
Red Hat OpenShift AI 2.25Red Hat
  • 1787330073 and laterNot affected
Red Hat OpenShift AI 3.3Red Hat
  • 1785187521 and laterNot affected
Red Hat OpenShift AI 3.4Red Hat
  • 1784993206 and laterNot affected
Red Hat OpenShift AI 3.4Red Hat
  • 1786614608 and laterNot affected
Red Hat OpenShift AI 3.5Red Hat
  • 1786552271 and laterNot affected
Red Hat OpenShift AI 3.5Red Hat
  • 1786552250 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.