Executive brief
A security flaw in the TrustyAI Service Operator allows internal network traffic to bypass identity verification when certain AI services are deployed. This means other programs within the same corporate cloud environment could access AI guardrails and orchestrators without permission. An attacker could use this access to view sensitive data or make unauthorized changes to how AI models behave.
Technical details
A vulnerability exists in the TrustyAI Service Operator where the 'RequiresAuth()' function in 'controllers/utils/auth.go' returns false if the 'security.opendatahub.io/enable-auth' annotation is missing. Because there is no CRD default or mutating webhook to enforce this setting, out-of-the-box deployments of services like gorch and NemoGuardrails serve plain HTTP endpoints without authentication or authorization. An attacker with access to a pod within the same cluster can interact with the AI guardrails and orchestrator APIs. This allows for unauthorized data retrieval and limited modification of AI model configurations. The issue is tracked as CVE-2026-15044.
Affected products
- Red Hat OpenShift AI (RHOAI) rhoai/odh-trustyai-service-operator-rhel9
Timeline
- 2026-07-08: disclosed: CVE published and reported by Red Hat