CVE-2026-18982

Odh-training-operator-rhel9: rhoai fork aggregates training job create onto native edit/admin clusterroles

8.8 High

A flaw was found in the RHOAI training-operator. This vulnerability allows a user with standard edit or admin roles in any Kubernetes namespace to escalate their privileges. Through the creation of training jobs, an attacker can impersonate service accounts, access the host filesystem, and potentially execute arbitrary code remotely. This issue arises from the aggregation of training job permissions onto native Kubernetes edit and admin ClusterRoles, coupled with unrestricted PodTemplateSpec passthrough.

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: Low
Privileges needed: Low
User interaction: None

What an attacker can affect

Confidentiality: High
Integrity: High
Availability: High

Exploit likelihood

0.79%Up 0.3 points since Aug 11, 2026

What each source reports

CVE List Score used 8.8

Odh-training-operator-rhel9: rhoai fork aggregates training job create onto native edit/admin clusterroles

Record: CVE-2026-18982
CVSS 3.1: 8.8 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Weakness: CWE-250
Updated: 2026-11-02

EUVDEUVD-2026-55822 8.8

Record: EUVD-2026-55822
CVSS 3.1: 8.8 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

GitHub AdvisoriesGHSA-v6pg-cp3x-x49r 8.8

A flaw was found in the RHOAI training-operator. This vulnerability allows a user with standard...

Record: GHSA-v6pg-cp3x-x49r
CVSS 3.1: 8.8 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Weakness: CWE-250
Updated: 2026-11-02

NVD 8.8

Record: CVE-2026-18982
CVSS 3.1: 8.8 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Weakness: CWE-250
Updated: 2026-11-02

Affected products

History

History
Recorded	Changed	Sources
Nov 2, 2026	first indexed	CVE List, EUVD, GitHub Advisories, NVD

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2026-18982 is a high vulnerability (CVSS 8.8) in Red Hat Openshift Ai 2.25, published August 10, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.79%, the 56th percentile. No source names a fixed version.