CVE-2026-83494

{
  "etk_id": "ETK-2026-3712",
  "cve_id": "CVE-2026-83494",
  "display_id": "CVE-2026-83494",
  "ghsa_id": "GHSA-4452-5gpc-g9w6",
  "euvd_id": "EUVD-2026-117966",
  "status": "published",
  "anchor_state": "anchored",
  "title": "PyTorchJob immutability-check bypass in training-operator",
  "summary": "RHOAI training-operator's PyTorchJob validation webhook can fail to enforce an immutability restriction because of incorrect object casting. A user able to reach the affected update path may detach queued jobs from quota management or alter controller ownership of running jobs, causing denial of service. The evidence does not specify the exact permissions required.",
  "mitigation": "Restrict PyTorchJob update and modification permissions to trusted administrators, and review changes to queued or running jobs. Apply the vendor-provided update when its applicable fixed release is identified; the evidence does not provide a fixed version.",
  "vendor": "Red Hat",
  "product": "Red Hat OpenShift AI (RHOAI)",
  "affected": [
    {
      "affected_notes": [],
      "affected_ranges": [],
      "ecosystem": null,
      "fixed_versions": [],
      "package_name": "rhoai/odh-training-operator-rhel9",
      "purl": null
    }
  ],
  "cwes": [
    693
  ],
  "cvss_score": null,
  "cvss_src": null,
  "cvss_vector": null,
  "epss_score": null,
  "epss_percentile": null,
  "epss_asof": null,
  "automation": "contextual",
  "check": false,
  "check_confidence_basis": null,
  "exploit": false,
  "pipeline_minutes": 48.80662211666667,
  "t0_at": "2026-11-06T06:39:12.292000+00:00",
  "signals": {
    "trigger_signal": {
      "at": "2026-11-06T06:39:12.292000+00:00",
      "days": 0,
      "is_lower_bound": false,
      "measured_at": "2026-11-06T06:39:12.292000+00:00",
      "url": "https://github.com/advisories/GHSA-4452-5gpc-g9w6"
    }
  }
}