{"id":"CVE-2026-83494","aliases":["EUVD-2026-117966","GHSA-4452-5gpc-g9w6"],"status":"published","title":"Training-operator: pytorchjob validateupdate casts oldjob from newobj, bypassing managedby immutability (asvs v5.1.3; upstream bug)","description":"A flaw was found in the training-operator. An incorrect object casting in the PyTorchJob ValidateUpdate webhook allows users to bypass an immutability check. This vulnerability could enable users to detach a queued job from its quota management system or hijack a running job's controller ownership. The primary impact is a Denial of Service (DoS) condition.","epss":{"day":"2026-11-12","score":0.00168,"percentile":0.0625,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-693"],"published":"2026-11-06T06:39:12Z","modified":"2026-11-06T09:31:31Z","products":[{"vendor":"red hat","product":"red hat openshift ai (rhoai)"}],"references":[{"url":"https://access.redhat.com/security/cve/CVE-2026-83494","tags":["vdb-entry","x_refsource_REDHAT"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2526348","tags":["issue-tracking","x_refsource_REDHAT"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-83494"},{"url":"https://github.com/advisories/GHSA-4452-5gpc-g9w6"}],"sources":{"cve":[{"id":"CVE-2026-83494","title":"Training-operator: pytorchjob validateupdate casts oldjob from newobj, bypassing managedby immutability (asvs v5.1.3; upstream bug)","description":"A flaw was found in the training-operator. An incorrect object casting in the PyTorchJob ValidateUpdate webhook allows users to bypass an immutability check. This vulnerability could enable users to detach a queued job from its quota management system or hijack a running job's controller ownership. The primary impact is a Denial of Service (DoS) condition.","status":"published","published":"2026-11-06T06:39:12.292Z","modified":"2026-11-06T06:39:12.292Z","cwes":["CWE-693"],"updated_at":"2026-11-06T07:27:10.786819Z"}],"euvd":[{"id":"EUVD-2026-117966","description":"A flaw was found in the training-operator. An incorrect object casting in the PyTorchJob ValidateUpdate webhook allows users to bypass an immutability check. This vulnerability could enable users to detach a queued job from its quota management system or hijack a running job's controller ownership. The primary impact is a Denial of Service (DoS) condition.","status":"published","published":"2026-11-06T06:39:12Z","modified":"2026-11-06T06:39:12Z","updated_at":"2026-11-06T12:04:49.431383Z"}],"ghsa":[{"id":"GHSA-4452-5gpc-g9w6","title":"A flaw was found in the training-operator. An incorrect object casting in the PyTorchJob...","description":"A flaw was found in the training-operator. An incorrect object casting in the PyTorchJob ValidateUpdate webhook allows users to bypass an immutability check. This vulnerability could enable users to detach a queued job from its quota management system or hijack a running job's controller ownership. The primary impact is a Denial of Service (DoS) condition.","status":"published","published":"2026-11-06T09:31:30Z","modified":"2026-11-06T09:31:31Z","cwes":["CWE-693"],"updated_at":"2026-11-06T09:59:38.586951Z"}],"nvd":[{"id":"CVE-2026-83494","description":"A flaw was found in the training-operator. An incorrect object casting in the PyTorchJob ValidateUpdate webhook allows users to bypass an immutability check. This vulnerability could enable users to detach a queued job from its quota management system or hijack a running job's controller ownership. The primary impact is a Denial of Service (DoS) condition.","status":"published","published":"2026-11-06T07:17:57.21Z","modified":"2026-11-06T07:18:00.937Z","cwes":["CWE-693"],"updated_at":"2026-11-06T12:00:00.011131Z"}]}}