{"id":"CVE-2026-83495","kind":"vulnerability","aliases":["CVE-2026-83495"],"related":[],"title":"Kubeflow Trainer: TrainJob users can read namespace secrets via env injection","description":"A flaw was found in the Trainer v2 TrainJob API. A user with permissions to create TrainJobs can exploit this by injecting `valueFrom.secretKeyRef` into environment variable definitions. This allows them to read and exfiltrate sensitive information (secrets) from the namespace, leading to a privilege escalation. This occurs when the TrainJob Role-Based Access Control (RBAC) is broader than the Secret read RBAC.","summary":"Trainer v2 accepts valueFrom.secretKeyRef in TrainJob env definitions, so a TrainJob creator can read same-namespace Secrets beyond their RBAC. Red Hat mitigation: align TrainJob RBAC with Secret read RBAC, or restrict secretKeyRef in the validating webhook to an allowlist of secret names. No fixed version published yet.","severity":"low","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"Red Hat OpenShift AI (Trainer v2, tech preview)","fixed":[],"affected":"unknown","ecosystem":"vendor"}],"ecosystems":[],"tags":["infrastructure","kubeflow","kubernetes","openshift-ai","rbac","self-hosted","trainer-v2"],"not_affected_if":["no-trainer-v2","no-trainjob-creators-untrusted","secret-rbac-matches-trainjob-rbac","trainer-not-installed","trainjob-creators-can-read-secrets"],"how_to_check":"Check whether Kubeflow Trainer v2 is installed (kubectl get crd trainjobs.trainer.kubeflow.org; on OpenShift AI, whether the Trainer v2 tech preview is enabled). Then compare who can create TrainJobs (kubectl auth can-i create trainjobs --as <user> -n <ns>) with who can read Secrets there; users who can create TrainJobs but not read Secrets are the exposure. Affected versions are not published yet.","fix":null,"status":"open","published_at":"2026-11-07T07:17:04+00:00","first_seen_at":"2026-11-07T07:46:07+00:00","triaged_at":"2026-11-07T07:47:18+00:00","updated_at":"2026-11-07T07:54:21+00:00","category":"infrastructure","confidence":0.7,"triage":{"at":"2026-11-07T07:47:18Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"Kubeflow Trainer: TrainJob users can read namespace secrets via env injection","impact":"high","summary":"The Trainer v2 TrainJob API accepts `valueFrom.secretKeyRef` in environment variable definitions. A user allowed to create TrainJobs can use this to read Secrets in the namespace, even without Secret read permission.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["kubernetes","kubeflow","trainer-v2","rbac"],"confidence":0.6,"fix_status":"unknown","needs_auth":"yes","worst_case":"namespace secrets readable by a user who lacks Secret access","analyst_note":"Sources give no affected or fixed versions and no product ranges; check the NVD entry and the Kubeflow Trainer project for the vulnerable versions and fix.","how_to_check":"unknown","plain_action":"","needs_analyst":true,"not_affected_if":["no-trainjob-creators-untrusted","secret-rbac-matches-trainjob-rbac","trainer-not-installed"],"who_is_affected":"Clusters running the Trainer v2 TrainJob API where users can create TrainJobs but are not granted read access to Secrets in the same namespace. The exposure comes from RBAC on TrainJobs being broader than RBAC on Secrets. Teams that restrict TrainJob creation to trusted operators, or that do not run Trainer v2, are not affected.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000702,"input_tokens":4250,"output_tokens":554,"severity_before":"unknown"},"analyst_status":"done","analyst_note":"Sources give no affected or fixed versions and no product ranges; check the NVD entry and the Kubeflow Trainer project for the vulnerable versions and fix.","search":"'-2026':13A,16A '-83495':14A,17A 'accept':41B 'access':141C 'ai':21A,31B 'align':63B 'allow':116C 'allowlist':79B 'api':97C 'base':140C 'beyond':57B 'broader':145C 'control':142C 'creat':103C 'creator':50B 'cve':12A,15A 'definit':46B,114C 'env':10A,45B 'environ':112C 'escal':132C 'exfiltr':121C 'exploit':106C 'fix':84B 'flaw':89C 'found':91C 'hat':19A,61B 'host':35B 'inform':123C 'infrastructur':26B 'inject':11A,109C 'kubeflow':1A,27B 'kubernet':28B 'lead':128C 'mitig':62B 'name':82B 'namespac':7A,55B,127C 'occur':134C 'openshift':20A,30B 'openshift-ai':29B 'permiss':101C 'preview':25A 'privileg':131C 'publish':86B 'rbac':32B,59B,65B,69B,143C,150C 'read':6A,52B,68B,119C,149C 'red':18A,60B 'restrict':71B 'role':139C 'role-bas':138C 'same-namespac':53B 'secret':8A,56B,67B,81B,124C,148C 'secretkeyref':72B 'self':34B 'self-host':33B 'sensit':122C 'tech':24A 'trainer':2A,22A,37B,39B,94C 'trainer-v2':36B 'trainjob':3A,44B,49B,64B,96C,104C,137C 'user':4A,99C 'v2':23A,38B,40B,95C 'valid':75B 'valuefrom.secretkeyref':42B,110C 'variabl':113C 'version':85B 'via':9A 'webhook':76B 'yet':87B","nicknames":[],"mitigations":[],"who_affected":"Clusters running Kubeflow Trainer v2 (in Red Hat OpenShift AI it is a Technology Preview feature) where some users can create TrainJobs but are not allowed to read Secrets. Such a user can put valueFrom.secretKeyRef in a TrainJob's environment variables and read Secrets in the same namespace. Clusters without Trainer v2, or where TrainJob creators can already read Secrets, can skip it.","tier":"C","verified":{"mitigations":{"at":"2026-11-07T07:48:47Z","by":"analyst","doc":"https://access.redhat.com/security/cve/CVE-2026-83495","run_id":2085},"workarounds":{"at":"2026-11-07T07:48:47Z","by":"analyst","doc":"https://access.redhat.com/security/cve/CVE-2026-83495","run_id":2085}},"analyst_revisit_at":null,"fix_status":"unknown","audience":"businesses","plain_action":null,"pkeys":["hatopenshiftaitrainerv2techpreview","redhatopenshiftaitrainerv2techpreview"],"ptokens":["ai","hat","openshift","preview","red","tech","trainer","v2"],"labels":["infrastructure","kubeflow","kubernetes","low","openshiftai","rbac","selfhosted","trainerv2"],"campaign_type":null,"search_a":"'-2026':13A,16A '-83495':14A,17A 'ai':21A 'cve':12A,15A 'env':10A 'hat':19A 'inject':11A 'kubeflow':1A 'namespac':7A 'openshift':20A 'preview':25A 'read':6A 'red':18A 'secret':8A 'tech':24A 'trainer':2A,22A 'trainjob':3A 'user':4A 'v2':23A 'via':9A","search_b":"'accept':41B 'ai':31B 'align':63B 'allowlist':79B 'beyond':57B 'creator':50B 'definit':46B 'env':45B 'fix':84B 'hat':61B 'host':35B 'infrastructur':26B 'kubeflow':27B 'kubernet':28B 'mitig':62B 'name':82B 'namespac':55B 'openshift':30B 'openshift-ai':29B 'publish':86B 'rbac':32B,59B,65B,69B 'read':52B,68B 'red':60B 'restrict':71B 'same-namespac':53B 'secret':56B,67B,81B 'secretkeyref':72B 'self':34B 'self-host':33B 'trainer':37B,39B 'trainer-v2':36B 'trainjob':44B,49B,64B 'v2':38B,40B 'valid':75B 'valuefrom.secretkeyref':42B 'version':85B 'webhook':76B 'yet':87B","search_c":"'access':141C 'allow':116C 'api':97C 'base':140C 'broader':145C 'control':142C 'creat':103C 'definit':114C 'environ':112C 'escal':132C 'exfiltr':121C 'exploit':106C 'flaw':89C 'found':91C 'inform':123C 'inject':109C 'lead':128C 'namespac':127C 'occur':134C 'permiss':101C 'privileg':131C 'rbac':143C,150C 'read':119C,149C 'role':139C 'role-bas':138C 'secret':124C,148C 'sensit':122C 'trainer':94C 'trainjob':96C,104C,137C 'user':99C 'v2':95C 'valuefrom.secretkeyref':110C 'variabl':113C","first_public_at":"2026-11-07T07:17:04+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-83495","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-83495","severity":null,"published_at":"2026-11-07T07:17:04+00:00","modified_at":"2026-11-07T07:17:05+00:00","first_seen_at":"2026-11-07T07:46:07+00:00","fetched_at":"2026-11-07T07:46:07+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-83495:2085","url":"https://access.redhat.com/security/cve/CVE-2026-83495","severity":null,"published_at":"2026-11-07T07:48:47+00:00","modified_at":"2026-11-07T07:48:47+00:00","first_seen_at":"2026-11-07T07:48:47+00:00","fetched_at":"2026-11-07T07:48:47+00:00","note":"Read Red Hat CVE page (vendor, assigner). Red Hat rates Low; Trainer v2 is a Tech Preview in OpenShift AI. No affected/fixed versions published anywhere yet; upstream kubeflow/trainer advisory not found. Severity lowered to Red Hat's own Low rating.","cites":["https://access.redhat.com/security/cve/CVE-2026-83495","https://access.redhat.com/security/cve/CVE-2026-83495","https://app.opencve.io/cve/CVE-2026-83495"]}],"documents":[{"id":93986,"url":"https://access.redhat.com/security/cve/CVE-2026-83495","title":"Red Hat CVE-2026-83495","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":93986,"url":"https://access.redhat.com/security/cve/CVE-2026-83495","title":"Red Hat CVE-2026-83495","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"mitigation","confidence":null,"note":null},{"id":93987,"url":"https://app.opencve.io/cve/CVE-2026-83495","title":"OpenCVE CVE-2026-83495","kind":"other","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"mentions","confidence":null,"note":null}],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}