CVE-2026-83494

Not scored yetLast modified Nov 6, 2026

Description

A flaw was found in the training-operator. An incorrect object casting in the PyTorchJob ValidateUpdate webhook allows users to bypass an immutability check. This vulnerability could enable users to detach a queued job from its quota management system or hijack a running job's controller ownership. The primary impact is a Denial of Service (DoS) condition.

Metrics

No CVSS score has been published yet.

Weakness enumeration

CWE-693

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

No affected versions have been published.

Timeline

Published
Nov 6, 2026
Last modified
Nov 6, 2026
NVD status
Awaiting Analysis

Related CVEs from 2026

CVE-2026-83495A flaw was found in the Trainer v2 TrainJob API. A user with permissions to create TrainJobs can exploit this by injecting `valueFrom.secretCVE-2026-834978.8Unrestricted deserialization of untrusted data in the cursor pagination component in the OpenSearch SQL plugin allows a remote authenticatedCVE-2026-834987.8Untrusted pointer dereference in Windows Virtualization-Based Security (VBS) Enclave allows an authorized attacker to elevate privileges locCVE-2026-834997.8Insufficient granularity of access control in Windows Server Update Service allows an authorized attacker to elevate privileges locally.CVE-2026-83508.8Concrete CMS 9.5.0 and below is vulnerable to missing authorization in the bulk_user_assignment.php which can lead to privilege escalation tCVE-2026-835006.1Url redirection to untrusted site ('open redirect') in Windows BitLocker allows an unauthorized attacker to bypass a security feature with aCVE-2026-835015.5Out-of-bounds read in Windows Virtualization-Based Security (VBS) Enclave allows an authorized attacker to disclose information locally.CVE-2026-835044.7Time-of-check time-of-use (toctou) race condition in Windows SmartScreen allows an authorized attacker to disclose information locally.CVE-2026-835057.0Time-of-check time-of-use (toctou) race condition in Windows Setup Files Cleanup allows an authorized attacker to elevate privileges locallyCVE-2026-835067.8Untrusted search path in Servicing Stack Updates allows an authorized attacker to elevate privileges locally.CVE-2026-835075.5Improper link resolution before file access ('link following') in Windows Update Orchestrator Service allows an authorized attacker to disclCVE-2026-835087.8Out-of-bounds read in Windows NTFS allows an authorized attacker to elevate privileges locally.
CVE-2026-83494: Unscored | Vulnix