Description

A flaw was found in the RHOAI training-operator. This vulnerability allows a user with standard edit or admin roles in any Kubernetes namespace to escalate their privileges. Through the creation of training jobs, an attacker can impersonate service accounts, access the host filesystem, and potentially execute arbitrary code remotely. This issue arises from the aggregation of training job permissions onto native Kubernetes edit and admin ClusterRoles, coupled with unrestricted PodTemplateSpec passthrough.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.8",
  "pubDate": "2026-08-10T21:17:21.833Z",
  "pubdate": "2026-08-10T21:17:21.833Z",
  "executiveSummary": "A privilege escalation vulnerability has been identified in the RHOAI training-operator. The flaw enables authenticated users holding standard edit or admin roles within any Kubernetes namespace to achieve severe privilege escalation across the cluster. The vulnerability stems from improper permission aggregation coupled with an insecurely configured PodTemplateSpec passthrough mechanism within the training job creation workflow.\nAn attacker possessing basic namespace-scoped administrative privileges can exploit this flaw by crafting malicious training jobs. This capability allows the threat actor to impersonate arbitrary service accounts, mount and interact with the underlying host filesystem, and execute arbitrary code remotely. The risk implications are critical, as a successful exploit compromises cluster-wide integrity and confidentiality.\nExploitation requires standard Kubernetes user access with edit or admin permissions inside a target namespace, alongside the ability to submit custom training job definitions to the RHOAI training-operator. No prior administrative cluster privileges are necessary to initiate the attack flow.",
  "technicalDetails": "The root cause of this vulnerability lies in the automatic aggregation of custom training job permissions onto native Kubernetes edit and admin ClusterRoles. When combined with unrestricted PodTemplateSpec passthrough in the RHOAI training-operator, users granted standard namespace editing capabilities inherit overly permissive cluster-level execution contexts.\nThe attack flow proceeds as follows: First, an attacker leverages their existing standard edit or admin role within a controlled Kubernetes namespace. Second, the attacker formulates a malicious custom resource definition payload representing a training job, exploiting the unrestricted PodTemplateSpec passthrough feature. Third, the training-operator processes the job definition, instantiating pods that inherit elevated privileges or impersonate high-privilege service accounts.\nUpon successful pod creation, the execution context allows the attacker to access the underlying host filesystem. By mounting sensitive host paths or leveraging the impersonated service account tokens, the attacker can interact with the Kubernetes API server with elevated credentials, leading to remote code execution and full post-exploitation compromise of the affected node or cluster infrastructure."
}