CVE-2026-83494
Training-operator: pytorchjob validateupdate casts oldjob from newobj, bypassing managedby immutability (asvs v5.1.3; upstream bug)
A flaw was found in the training-operator. An incorrect object casting in the PyTorchJob ValidateUpdate webhook allows users to bypass an immutability check. This vulnerability could enable users to detach a queued job from its quota management system or hijack a running job's controller ownership. The primary impact is a Denial of Service (DoS) condition.
Exploit likelihood
What each source reports
CVE List No score
Training-operator: pytorchjob validateupdate casts oldjob from newobj, bypassing managedby immutability (asvs v5.1.3; upstream bug)
A flaw was found in the training-operator. An incorrect object casting in the PyTorchJob ValidateUpdate webhook allows users to bypass an immutability check. This vulnerability could enable users to detach a queued job from its quota management system or hijack a running job's controller ownership. The primary impact is a Denial of Service (DoS) condition.
- Record
CVE-2026-83494- Weakness
- CWE-693
- Updated
- 2026-11-06
EUVDEUVD-2026-117966 No score
A flaw was found in the training-operator. An incorrect object casting in the PyTorchJob ValidateUpdate webhook allows users to bypass an immutability check. This vulnerability could enable users to detach a queued job from its quota management system or hijack a running job's controller ownership. The primary impact is a Denial of Service (DoS) condition.
- Record
EUVD-2026-117966- Updated
- 2026-11-06
GitHub AdvisoriesGHSA-4452-5gpc-g9w6 No score
A flaw was found in the training-operator. An incorrect object casting in the PyTorchJob...
A flaw was found in the training-operator. An incorrect object casting in the PyTorchJob ValidateUpdate webhook allows users to bypass an immutability check. This vulnerability could enable users to detach a queued job from its quota management system or hijack a running job's controller ownership. The primary impact is a Denial of Service (DoS) condition.
- Record
GHSA-4452-5gpc-g9w6- Weakness
- CWE-693
- Updated
- 2026-11-06
NVD No score
A flaw was found in the training-operator. An incorrect object casting in the PyTorchJob ValidateUpdate webhook allows users to bypass an immutability check. This vulnerability could enable users to detach a queued job from its quota management system or hijack a running job's controller ownership. The primary impact is a Denial of Service (DoS) condition.
- Record
CVE-2026-83494- Weakness
- CWE-693
- Updated
- 2026-11-06
Affected products
History
| Recorded | Changed | Sources |
|---|---|---|
| published | EUVD, NVD | |
| published | EUVD | |
| aliases, references | GitHub Advisories | |
| aliases, published | EUVD | |
| first indexed | CVE List |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2026-83494 is a vulnerability with no CVSS score yet in Red Hat Openshift Ai (rhoai), published November 6, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.17%, the 6th percentile. No source names a fixed version.