CVE-2026-15044

{
  "id": "CVE-2026-15044",
  "sourceIdentifier": "[email protected]",
  "published": "2026-07-08T15:16:26.120",
  "lastModified": "2026-10-26T18:17:45.890",
  "vulnStatus": "Awaiting Analysis",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "A flaw was found in the TrustyAI Service Operator. When deploying services like gorch or NemoGuardrails, if a specific security setting is not enabled, these services can expose their communication channels without requiring users to prove their identity. This allows any other program within the cluster to access the AI guardrails and orchestrator without proper authorization. An attacker could exploit this to gain unauthorized access to sensitive information and potentially make limited changes to the AI models."
    },
    {
      "lang": "es",
      "value": "Se encontró una falla en el Operador de Servicio TrustyAI. Al desplegar servicios como gorch o NemoGuardrails, si una configuración de seguridad específica no está habilitada, estos servicios pueden exponer sus canales de comunicación sin requerir que los usuarios prueben su identidad. Esto permite a cualquier otro programa dentro del clúster acceder a las barreras de seguridad de IA y al orquestador sin la debida autorización. Un atacante podría explotar esto para obtener acceso no autorizado a información sensible y potencialmente realizar cambios limitados en los modelos de IA."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "TrustyAI",
          "product": "trustyai-service-operator",
          "defaultStatus": "unaffected",
          "collectionURL": "https://github.com/trustyai-explainability/trustyai-service-operator",
          "packageName": "trustyai-service-operator",
          "versions": [
            {
              "version": "0",
              "lessThan": "*",
              "versionType": "semver",
              "status": "affected"
            }
          ]
        },
        {
          "vendor": "Red Hat",
          "product": "Red Hat OpenShift AI (RHOAI)",
          "defaultStatus": "affected",
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "packageName": "rhoai/odh-trustyai-service-operator-rhel9",
          "cpes": [
            "cpe:/a:redhat:openshift_ai"
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "[email protected]",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N",
          "baseScore": 6.3,
          "baseSeverity": "MEDIUM",
          "attackVector": "ADJACENT_NETWORK",
          "attackComplexity": "LOW",
          "privilegesRequired": "LOW",
          "userInteraction": "NONE",
          "scope": "UNCHANGED",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "LOW",
          "availabilityImpact": "NONE"
        },
        "exploitabilityScore": 2.1,
        "impactScore": 4.2
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2026-07-09T13:41:04.256259Z",
          "id": "CVE-2026-15044",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "[email protected]",
      "type": "Primary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-306"
        }
      ]
    },
    {
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-200"
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://access.redhat.com/security/cve/CVE-2026-15044",
      "source": "[email protected]"
    },
    {
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2498039",
      "source": "[email protected]"
    }
  ]
}