The vulnerability resides in the OpenShift AI training‑operator. By merging the permissions of native Kubernetes edit and admin ClusterRoles into the creation of training jobs and accepting arbitrary PodTemplateSpec objects without validation, any user who holds edit or admin rights in a Kubernetes namespace can create a training job that impersonates a service account. This allows the attacker to access the host filesystem and potentially launch arbitrary code on the host node. The flaw exemplifies a failure of authorization (CWE‑250).

Affected vendors and products include Red Hat OpenShift AI (RHOAI). Any installation that includes the training‑operator, regardless of the cluster or node version, is vulnerable as the description provides no specific version constraints. Consequently, all current copies of the operator deployed in a cluster are potentially affected.

The CVSS score of 8.8 indicates high severity. EPSS data is unavailable, but the lack of a KEV listing suggests exploitation is not currently widespread. The attack vector is internal to a Kubernetes cluster: a user with edit or admin privileges in any namespace can trigger the flaw without external network reach, and successful exploitation leads to privilege escalation and remote code execution on the host, giving an attacker full control of the node. The vulnerability is therefore a high‑risk assault vector for privileged users.