CVE-2026-83494 · Infrastructure
NO FIX YET
The training-operator's PyTorchJob update webhook casts an object incorrectly, so its immutability check can be bypassed. A user with permission to edit jobs can detach a queued job from its quota system or take over a running job's controller ownership, mainly causing denial of service.
first public Nov 6, 2026 · 1 source
Check it with your coding agent
It checks your repository and tells you if you’re affected, with the fix.
Teams running the Kubeflow training-operator on Kubernetes with PyTorchJob resources, where users can create or update jobs. The sources do not say which versions are affected or whether the default install enables the webhook. Clusters without the training-operator or without untrusted job editors are unlikely to be exposed.
Not affected if no-training-operator, no-untrusted-job-users
Who cares kubeflow, kubernetes, pytorch, training-operator
Unknown from the sources.
No fix yet, per the sources.
A flaw was found in the training-operator. An incorrect object casting in the PyTorchJob ValidateUpdate webhook allows users to bypass an immutability check. This vulnerability could enable users to detach a queued job from its quota management system or hijack a running job's controller ownership. The primary impact is a Denial of Service (DoS) condition.
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.