AI and data stack advisories

Severe, 6 weeks1496Projects326

1496 severe, 6 weeks · 326 projects

Red HatCVE-2026-15044

Red Hat TrustyAI Service Operator.: information disclosure

Red Hat

CVE-2026-15044 · Published Jul 8, 2026 · updated Aug 31, 2026

Medium6.3
No fix yet
Red Hat advisory

A flaw was found in the TrustyAI Service Operator. When deploying services like gorch or NemoGuardrails, if a specific security setting is not enabled, these services can expose their communication channels without requiring users to prove their identity. This allows any other program within the cluster to access the AI guardrails and orchestrator without proper authorization. An attacker could exploit this to gain unauthorized access to sensitive information and potentially make limited changes to the AI models.

Affected versions

PackageAffectedFixed in
Red Hat OpenShift AI (RHOAI)
Product
all versionsNo fix yet
trustyai-service-operator
Product
all versionsNo fix yet
Details and references
CVSS 3.1
CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N
Severity from
the vendor (its own CVE record or advisory)
Weakness
CWE-200

More Red Hat advisories

All Red Hat