CVE-2025-12103Medium· 5.0▾ SunlitA flaw was found in Red Hat Openshift AI Service. The TrustyAI component is granting all service accounts and users on a cluster permissions to get, list, watch any pod in any namespace on the cluster. TrustyAI is creating a role `trus…
▾ Sunlit zone — Low / medium · no exploitation signal
impact 27.5 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Jul 19.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
Last analysed / modified upstream
0.2%
0.2% → 0.2%
A flaw was found in Red Hat Openshift AI Service. The TrustyAI component is granting all service accounts and users on a cluster permissions to get, list, watch any pod in any namespace on the cluster.
TrustyAI is creating a role trustyai-service-operator-lmeval-user-role and a CRB trustyai-service-operator-default-lmeval-user-rolebinding which is being applied to system:authenticated making it so that every single user or service account can get a list of pods running in any namespace on the cluster
Additionally users can access all persistentvolumeclaims and lmevaljobs
Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-94425High· 8.8A vulnerability was found in Moore Threads MTT S80 Driver Package 340.150
CVE-2026-15467High· 8.1A flaw was found in the trustyai-service-operator's LMEvalJob controller
CVE-2026-94048Medium· 6.6A vulnerability was detected in CodeAstro QR Code Attendance Management System 1.0
CVE-2026-94047Medium· 6.3A security vulnerability has been detected in samanhappy MCPHub up to 1.0.32
CVE-2026-94036High· 8.8A security flaw has been discovered in D-Link DIR-X1860 and DIR-X1860Z up to 1.0.2.220120.165402
CVE-2026-93968Low· 3.8A vulnerability was determined in aiyiyi121 SxDevOps 1.0/1.1