Vulnerability · Published Jul 8, 2026 · Assigned by redhat

CVE-2026-15063Trustyai-service-operator: trustyai service operator: gorch port bypass when auth is enabled

Medium 6.3

In plain English

A medium-severity missing authentication in Red Hat OpenShift AI (RHOAI) from Red Hat. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 20% of all known vulnerabilities).

Severity (CVSS 3.1)6.3Medium

Exploit odds (30 days)0.3%top 79.6% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

A flaw was found in the gorch service template, which is part of the trustyai-service-operator. Even when authentication is enabled, the gorch service exposes unproxied orchestrator and detector metrics ports. This allows any pod on the cluster network to directly access these ports, bypassing the kube-rbac-proxy and its authentication mechanisms. This could lead to unauthorized access to the orchestrator and detector metrics.

Affected products (as reported)

Vendor	Product	Versions
trustyai-explainability	trustyai-service-operator	0 – before *
Red Hat	Red Hat OpenShift AI (RHOAI)	see references

Weakness: CWE-306 · Vector: CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N

References

https://access.redhat.com/security/cve/CVE-2026-15063 vdb-entry, x_refsource_REDHAT
RHBZ#2498058 issue-tracking, x_refsource_REDHAT