CVE-2026-83495

— UNSCORED

Published 2026-11-07 · Updated 2026-11-07

AI analysis for this CVE has not been generated yet. Raw NVD data is shown below.

NVD description

A flaw was found in the Trainer v2 TrainJob API. A user with permissions to create TrainJobs can exploit this by injecting `valueFrom.secretKeyRef` into environment variable definitions. This allows them to read and exfiltrate sensitive information (secrets) from the namespace, leading to a privilege escalation. This occurs when the TrainJob Role-Based Access Control (RBAC) is broader than the Secret read RBAC.

Weaknesses

CWE-269

All references

https://access.redhat.com/security/cve/CVE-2026-83495
https://bugzilla.redhat.com/show_bug.cgi?id=2526350

Source data: NVD (nvd.nist.gov), public domain. Exploit-DB.ai adds local AI analysis for defensive use only.

Related CVEs

HIGHCVE-2020-9709
HIGHCVE-2024-58390PoC
HIGHCVE-2025-11229
MEDIUMCVE-2025-14123
HIGHCVE-2025-71421PoC
HIGHCVE-2026-100363PoC
HIGHCVE-2026-100578PoC
HIGHCVE-2026-100586PoC

Related by shared AI tags and CWE weakness class. Browse the full archive.