The vulnerability CVE-2026-15581 affects the TrustyAI Service (TAS) in Red Hat OpenShift AI (RHOAI) deployments. Due to missing authentication on the TAS backend API, any pod within the cluster network can bypass the kube-rbac-proxy security control and access the API without authorization. This allows an attacker to read, tamper with, or delete monitoring data and configurations, as well as inject arbitrary data into the service. The issue is classified under CWE-306 (Missing Authentication for Critical Function). The vulnerability has a CVSS v3.1 base score of 8.0 with metrics indicating low attack complexity and privileges required, no user interaction, and high impact on confidentiality, integrity, and availability. No official fix or patch is currently confirmed by Red Hat, and the vendor advisory states the issue is rated important but does not provide remediation details yet.

Exploitation of this vulnerability allows unauthorized pods on the cluster network to bypass authentication controls and directly access the TAS backend API. This can lead to unauthorized reading, modification, or deletion of monitoring data and configurations, as well as injection of arbitrary data into the service. The impact affects data confidentiality, integrity, and availability, potentially disrupting tenant operations within the affected OpenShift AI environment.

Patch status is not yet confirmed — check the Red Hat advisory at https://access.redhat.com/security/cve/CVE-2026-15581 for current remediation guidance. Until a fix is available, consider restricting pod network access to the TAS backend API and monitor for unauthorized access attempts. Customers with Red Hat Technical Account Managers (TAM) can consult directly for tailored mitigation advice. No official fix or temporary workaround is currently documented by Red Hat.