Kubeflow Training Operator (RHOAI overlay, trainjobs aggregated into the edit ClusterRole): The RHOAI overlay

Impact

The RHOAI overlay aggregates trainjobs create/update/delete into Kubernetes' built-in edit ClusterRole, so every namespace editor silently gains full control over training jobs. Chained with the companion flaw that allows arbitrary pod configuration in a TrainJob, a tenant with routine edit rights escalates to arbitrary code execution on the GPU nodes their jobs land on.

Who can reach it

Any principal bound to the standard edit ClusterRole in a namespace where the training operator is installed - a very common default for application teams.

What to do

Apply the Red Hat OpenShift AI errata (RHSA-2026:53262/53263). Independently, audit which ClusterRoles aggregate trainjobs verbs in your own overlays and split TrainJob management into a dedicated role instead of folding it into edit.

References