Vulnerabilities

TI-2026-15262 CVE-2026-18620 · GHSA-g68c-wmxr-x3rh

Data-sciences-pipeline: user-controlled serviceaccount for workflow pods without authorization check — confused deputy

LOW 32

A flaw was found in Data Science Pipelines.

CVSS 3.1HIGH 7.1 Network Low privileges No interaction EPSS 0.00478 Published 2026-08-10 Fixed in 1785189934, 1788256711 +5 CWE-639

TI-2026-15261 CVE-2026-18618 · GHSA-cr6h-6g58-pq2g

MEDIUM 40

A flaw was found in ml-metadata.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00846 Published 2026-08-10 Fixed in 1785260280, 1785262015 +4 CWE-770

TI-2026-15254 CVE-2026-18611 · GHSA-5qmg-pgg7-3rjj

MEDIUM 40

A flaw was found in the Data Science Pipelines Operator.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00606 Published 2026-08-10 Fixed in 1785189332, 1788182334 +5 CWE-338

TI-2026-15512 CVE-2026-18982 · GHSA-v6pg-cp3x-x49r

MEDIUM 41

A flaw was found in the RHOAI training-operator.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.00791 Published 2026-08-10 Fixed in 1785187053, 1785188461 +4 CWE-250

TI-2026-15489 CVE-2026-18951 · GHSA-h7xh-qc2m-rc58

MEDIUM 42

A flaw was found in the Red Hat OpenShift AI (RHOAI) overlay for the training operator.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.00915 Published 2026-08-10 Fixed in 1785188461, 1790137153 +4 CWE-267

TI-2026-15260 CVE-2026-18617 · GHSA-g6qh-932v-chpq

MEDIUM 41

A flaw was found in the Data Science Pipelines Operator (DSPO).

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.00733 Published 2026-08-10 Fixed in 1785189332, 1788182334 +5 CWE-915

TI-2026-15252 CVE-2026-18608 · GHSA-vh9j-mvrr-922q

MEDIUM 41

A flaw was found in the Data Science Pipelines Operator (DSPO).

CVSS 3.1HIGH 8.7 Network High privileges No interaction EPSS 0.007 Published 2026-08-10 Fixed in 1785189332, 1788182334 +5 CWE-250

TI-2026-13112 CVE-2026-15581 · GHSA-7rjm-5cpg-vwpq

LOW 37

A flaw was found in the TrustyAI Service (TAS) deployment.

CVSS 3.1HIGH 8.0 Adjacent network Low privileges No interaction EPSS 0.00417 Published 2026-08-10 Fixed in 1785187119, 1787330073 +5 CWE-306

TI-2026-13009 CVE-2026-15467 · GHSA-qw34-v3jw-3crv

LOW 38

A flaw was found in the trustyai-service-operator's LMEvalJob controller.

CVSS 3.1HIGH 8.1 Network Low privileges No interaction EPSS 0.00597 Published 2026-08-10 Fixed in 1785187119, 1785187521 +4 CWE-266