CVE-2026-83495

Not scored yetLast modified Nov 7, 2026

Description

A flaw was found in the Trainer v2 TrainJob API. A user with permissions to create TrainJobs can exploit this by injecting `valueFrom.secretKeyRef` into environment variable definitions. This allows them to read and exfiltrate sensitive information (secrets) from the namespace, leading to a privilege escalation. This occurs when the TrainJob Role-Based Access Control (RBAC) is broader than the Secret read RBAC.

Metrics

No CVSS score has been published yet.

Weakness enumeration

CWE-269

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

VendorProductVersions
Red HatRed Hat OpenShift AI (RHOAI)—

References

Timeline

Published
Nov 7, 2026
Last modified
Nov 7, 2026
NVD status
Awaiting Analysis

Related CVEs from 2026

CVE-2026-834978.8Unrestricted deserialization of untrusted data in the cursor pagination component in the OpenSearch SQL plugin allows a remote authenticatedCVE-2026-834987.8Untrusted pointer dereference in Windows Virtualization-Based Security (VBS) Enclave allows an authorized attacker to elevate privileges locCVE-2026-834997.8Insufficient granularity of access control in Windows Server Update Service allows an authorized attacker to elevate privileges locally.CVE-2026-83508.8Concrete CMS 9.5.0 and below is vulnerable to missing authorization in the bulk_user_assignment.php which can lead to privilege escalation tCVE-2026-835006.1Url redirection to untrusted site ('open redirect') in Windows BitLocker allows an unauthorized attacker to bypass a security feature with aCVE-2026-835015.5Out-of-bounds read in Windows Virtualization-Based Security (VBS) Enclave allows an authorized attacker to disclose information locally.CVE-2026-835044.7Time-of-check time-of-use (toctou) race condition in Windows SmartScreen allows an authorized attacker to disclose information locally.CVE-2026-835057.0Time-of-check time-of-use (toctou) race condition in Windows Setup Files Cleanup allows an authorized attacker to elevate privileges locallyCVE-2026-835067.8Untrusted search path in Servicing Stack Updates allows an authorized attacker to elevate privileges locally.CVE-2026-835075.5Improper link resolution before file access ('link following') in Windows Update Orchestrator Service allows an authorized attacker to disclCVE-2026-835087.8Out-of-bounds read in Windows NTFS allows an authorized attacker to elevate privileges locally.CVE-2026-835097.0Untrusted search path in Windows Setup Files Cleanup allows an authorized attacker to elevate privileges locally.
CVE-2026-83495: Unscored | Vulnix