CVE-2026-83494
Description
A flaw was found in the training-operator. An incorrect object casting in the PyTorchJob ValidateUpdate webhook allows users to bypass an immutability check. This vulnerability could enable users to detach a queued job from its quota management system or hijack a running job's controller ownership. The primary impact is a Denial of Service (DoS) condition.
Statement
This Moderate impact flaw in the training-operator component of Red Hat OpenShift AI allows authenticated users to bypass an immutability check for PyTorchJob resources. This could enable users to alter the spec.runPolicy.managedBy field after job creation, potentially disrupting resource quota management or hijacking job controller ownership, leading to a denial of service.
Mitigation
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
Understanding the Weakness (CWE)
Access Control
Technical Impact: Bypass Protection Mechanism
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
