CVE-2026-15044 Trustyai-service-operator: trustyai service operator: unauthenticated access to ai guardrails and orchestrator apis

A flaw was found in the TrustyAI Service Operator. When deploying services like gorch or NemoGuardrails, if a specific security setting is not enabled, these services can expose their communication channels without requiring users to prove their identity. This allows any other program within the...

CVE-2026-15044 Trustyai-service-operator: trustyai service operator: unauthenticated access to ai guardrails and orchestrator apis

A flaw was found in the TrustyAI Service Operator. When deploying services like gorch or NemoGuardrails, if a specific security setting is not enabled, these services can expose their communication channels without requiring users to prove their identity. This allows any other program within the...

EUVD-2026-42283

A flaw was found in the TrustyAI Service Operator. When deploying services like gorch or NemoGuardrails, if a specific security setting is not enabled, these services can expose their communication channels without requiring users to prove their identity. This allows any other program within the...

CVE-2026-15044

The CVE concerns the TrustyAI Service Operator. In deployments of services such as gorch and NemoGuardrails, if a specific security setting is not enabled, communication channels can be exposed without requiring user authentication, allowing any other program in the cluster to access the AI guard...

CVE-2026-15044: Exposure of Sensitive Information to an Unauthorized Actor

A flaw was found in the TrustyAI Service Operator. When deploying services like gorch or NemoGuardrails, if a specific security setting is not enabled, these services can expose their communication channels without requiring users to prove their identity. This allows any other program within the...

PT-2026-56458

Name of the Vulnerable Software and Affected Versions TrustyAI Service Operator affected versions not specified Description A flaw in the TrustyAI Service Operator occurs when deploying services such as gorch or NemoGuardrails. If a specific security setting is not enabled, these services expose...

CVE-2026-15063: Missing Authentication for Critical Function

A flaw was found in the gorch service template, which is part of the trustyai-service-operator. Even when authentication is enabled, the gorch service exposes unproxied orchestrator and detector metrics ports. This allows any pod on the cluster network to directly access these ports, bypassing th...

CVE-2026-41178 vulnerabilities

Vulnerabilities for packages: metrics-server-fips, k8sgateway, aws-fsx-csi-driver-fips, kube-logging-operator-fips, gitsign, goose, otel-cli, flux-helm-controller, snyk-cli, cluster-api, sqlexporter, redpanda-operator, gotrue, neuvector-sigstore-interface, crossplane-provider-aws-sqs-fips,...

GHSA-5WRP-CWCJ-Q835 vulnerabilities

Vulnerabilities for packages: metrics-server-fips, k8sgateway, aws-fsx-csi-driver-fips, kube-logging-operator-fips, gitsign, goose, otel-cli, flux-helm-controller, snyk-cli, cluster-api, sqlexporter, redpanda-operator, gotrue, neuvector-sigstore-interface, crossplane-provider-aws-sqs-fips,...

CVE-2026-41889 vulnerabilities

Vulnerabilities for packages: dapr, grafana-fips, goose, sqlexporter, spqr, keda, splunk-otel-collector, gotrue, jitsucom-bulker, timescaledb-parallel-copy, step-issuer-fips, kube-bench, vault, flyte, wal-g, sqlexporter-fips, argo-workflows-fips, splunk-otel-collector-fips, step, cerbos,...

CVE-2025-12103: Incorrect Privilege Assignment

A flaw was found in Red Hat Openshift AI Service. The TrustyAI component is granting all service accounts and users on a cluster permissions to get, list, watch any pod in any namespace on the cluster. TrustyAI is creating a role trustyai-service-operator-lmeval-user-role and a CRB...

CVE-2025-22874 vulnerabilities

Vulnerabilities for packages: nginx-prometheus-exporter, buf, k9s, kyverno-policy-reporter-ui, blobfuse2, mkcert, yunikorn-k8shim, restic, nsc, minify, percona-server-mongodb-operator, protoc-gen-go-grpc, configmap-reload, sftpgo-plugin-eventsearch, paranoia, dbmate, x509-certificate-exporter,...

GHSA-6F52-WPX2-HVF2 vulnerabilities

Vulnerabilities for packages: nginx-prometheus-exporter, buf, k9s, kyverno-policy-reporter-ui, blobfuse2, mkcert, yunikorn-k8shim, restic, nsc, minify, percona-server-mongodb-operator, protoc-gen-go-grpc, configmap-reload, sftpgo-plugin-eventsearch, paranoia, dbmate, x509-certificate-exporter,...

GHSA-62JJ-GR2R-5C34 vulnerabilities

Vulnerabilities for packages: nginx-prometheus-exporter, buf, k9s, kyverno-policy-reporter-ui, blobfuse2, mkcert, yunikorn-k8shim, restic, nsc, minify, percona-server-mongodb-operator, protoc-gen-go-grpc, configmap-reload, paranoia, dbmate, x509-certificate-exporter, kubernetes-dashboard-api,...

CVE-2025-4673 vulnerabilities

Vulnerabilities for packages: nginx-prometheus-exporter, buf, k9s, kyverno-policy-reporter-ui, blobfuse2, mkcert, yunikorn-k8shim, restic, nsc, minify, percona-server-mongodb-operator, protoc-gen-go-grpc, configmap-reload, paranoia, dbmate, x509-certificate-exporter, kubernetes-dashboard-api,...

File Upload Vulnerability in the Command and Dispatch Management Platform of Fujian Qualicom Communication Co.

Fujian Qualicom Communication Co., Ltd. is a solution provider and service operator focusing on professional communication. A file upload vulnerability exists in the Command and Dispatch Management Platform of Fujian Qualicom Communication Co. Ltd. that can be exploited by an attacker to upload a...