The Red Hat OpenShift AI (RHOAI) overlay incorrectly aggregates TrainJobs management permissions into the native Kubernetes 'edit ClusterRole', allowing any user with 'edit ClusterRole' permissions in a namespace to manage TrainJobs. This flaw, combined with a separate vulnerability (TRN-01) that allows arbitrary pod configurations, could be exploited by a remote attacker with namespace editor privileges to escalate privileges and potentially execute arbitrary code. The vulnerability is tracked as CVE-2026-18951 with a CVSS 3.1 score of 8.8 (high severity). Red Hat has published security advisories RHSA-2026:53262 and RHSA-2026:53263 with updated images for RHOAI versions 3.4.3 and 3.3.6 respectively, which include multiple CVE fixes including CVE-2026-18951. However, the advisories do not explicitly state a direct fix for this CVE, only that updated images are available and users should upgrade following Red Hat's documentation.

Users with Kubernetes 'edit ClusterRole' permissions in a namespace can create, modify, and delete TrainJobs due to improper permission aggregation. When combined with another vulnerability allowing arbitrary pod configurations, this can lead to privilege escalation and arbitrary code execution within the cluster. This poses a significant risk to the confidentiality, integrity, and availability of affected OpenShift AI deployments.

Red Hat has released updated images for Red Hat OpenShift AI versions 3.3.6 and 3.4.3 that address multiple vulnerabilities including CVE-2026-18951. Users should upgrade to these versions following the official Red Hat OpenShift AI upgrade documentation to fully apply the errata updates. Patch status is confirmed by the vendor advisories. No alternative mitigations or 'no action required' statements are provided, so applying the vendor updates is the recommended remediation.