Description
A flaw was found in the gorch service template, which is part of the trustyai-service-operator. Even when authentication is enabled, the gorch service exposes unproxied orchestrator and detector metrics ports. This allows any pod on the cluster network to directly access these ports, bypassing the kube-rbac-proxy and its authentication mechanisms. This could lead to unauthorized access to the orchestrator and detector metrics.
Published: 2026-07-08
Score: 6.3 Medium
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

The gorch service template used by the trustyai-service-operator exposes its orchestrator and detector metrics ports without proper authentication even when the overall service has authentication enabled. This flaw, a Missing Authentication issue (CWE‑306), allows any pod on the OpenShift AI cluster network to reach the unproxied metrics endpoints, bypassing the kube-rbac-proxy and its authentication checks. The consequence is that an adversary can read detailed metrics that may reveal internal system state, operational parameters, or other sensitive information that could aid further attacks.

Affected Systems

Red Hat OpenShift AI installations that contain the trustyai-service-operator are affected. No specific version information is supplied, suggesting that the issue may exist across all current releases until addressed by a patch.

Risk and Exploitability

The CVSS score of 6.3 reflects moderate severity, while the EPSS score of < 1 % indicates that exploitation is unlikely but not impossible. The vulnerability is not listed in the CISA KEV catalog. Attackers can exploit the flaw by establishing an internal connection from any pod within the cluster to the exposed metrics ports, thereby bypassing the intended authentication controls. The weakness is a classic Missing Authentication issue (CWE‑306).

Generated by OpenCVE AI on July 26, 2026 at 17:45 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade Red Hat OpenShift AI to a release that includes the fix for the trustyai-service-operator gorch port bypass.
  • Apply network policies or firewall rules to restrict pod access to the gorch service’s metrics ports until the patch is deployed.
  • Enforce kube‑rbac‑proxy or a similar authentication layer on the metrics endpoints, if the operator permits configuration overrides.
  • Restrict pod network reachability by applying Pod Security Policies or OpenShift security contexts that prevent untrusted pods from contacting the gorch metrics ports.
  • Audit and disable any external or unmanaged metrics endpoints exposed by the operator, ensuring that only authorized endpoints remain available.

Generated by OpenCVE AI on July 26, 2026 at 17:45 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Thu, 09 Jul 2026 00:15:00 +0000

Type Values Removed Values Added
References
Metrics threat_severity

None

 threat_severity

Moderate

Wed, 08 Jul 2026 16:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Wed, 08 Jul 2026 15:45:00 +0000

Type Values Removed Values Added
Description A flaw was found in the gorch service template, which is part of the trustyai-service-operator. Even when authentication is enabled, the gorch service exposes unproxied orchestrator and detector metrics ports. This allows any pod on the cluster network to directly access these ports, bypassing the kube-rbac-proxy and its authentication mechanisms. This could lead to unauthorized access to the orchestrator and detector metrics.
Title Trustyai-service-operator: trustyai service operator: gorch port bypass when auth is enabled
First Time appeared Redhat
Redhat openshift Ai
Weaknesses CWE-306
CPEs cpe:/a:redhat:openshift_ai
Vendors & Products Redhat
Redhat openshift Ai
References
Metrics cvssV3_1

{'score': 6.3, 'vector': 'CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N'}

Subscriptions

Redhat Openshift Ai
cve-icon MITRE

Status: PUBLISHED

Assigner: redhat

Published:

Updated: 2026-07-08T15:56:34.556Z

Reserved: 2026-07-08T14:31:24.772Z

Link: CVE-2026-15063

cve-icon Vulnrichment

Updated: 2026-07-08T15:56:31.003Z

cve-icon NVD

No data.

cve-icon Redhat

Severity : Moderate

Publid Date: 2026-07-08T00:00:00Z

Links: CVE-2026-15063 - Bugzilla

cve-icon OpenCVE Enrichment

Updated: 2026-07-26T17:45:17Z

Weaknesses
  • CWE-306

    Missing Authentication for Critical Function