CVE-2026-83494: vulnerability in Red Hat OpenShift AI (RHOAI)
Training-operator: pytorchjob validateupdate casts oldjob from newobj, bypassing managedby immutability (asvs v5.1.3; upstream bug)
Published
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
3Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackepss 0.2%
A flaw was found in the training-operator. An incorrect object casting in the PyTorchJob ValidateUpdate webhook allows users to bypass an immutability check. This vulnerability could enable users to detach a queued job from its quota management system or hijack a running job's controller ownership. The primary impact is a Denial of Service (DoS) condition.
Affected products
Red Hat · Red Hat OpenShift AI (RHOAI)Related CVEs — Red Hat OpenShift AI (RHOAI)
In the same product, most dangerous first.
CVE-2026-23536HIGHFeast: unauthenticated arbitrary file readEPSS 2.5%CVE-2024-11831MEDIUMNpm-serialize-javascript: cross-site scripting (xss) in serialize-javascriptEPSS 1.1%CVE-2026-18948CRITICALFeast: feast: unsafe dill deserialization of registry-stored udfs — rce on feature server and registry serverEPSS 1.1%CVE-2026-23537CRITICALFeast: unauthenticated arbitrary file writeEPSS 1.0%CVE-2026-0603HIGHOrg.hibernate/hibernate-core: hibernate: information disclosure and data deletion via second-order sql injectionEPSS 1.0%CVE-2026-0990MEDIUMLibxml2: libxml2: denial of service via uncontrolled recursion in xml catalog processingEPSS 1.0%