CVE-2026-15581
HighCVSS 8.0Exploitation Probability (EPSS)
Low risk16th percentile - higher than 16% of all known CVEs
Summary
A flaw was found in the TrustyAI Service (TAS) deployment that allows any pod on the cluster network to bypass authentication and directly access the TAS backend API. An attacker can read, tamper with, or delete monitoring data and configurations, and inject arbitrary data, potentially disrupting tenant operations.
Risk Assessment
The risk includes unauthorized access to monitoring data and configurations, potentially leading to data integrity issues and service disruption.
Recommendation
Implement authentication for access to the TAS backend API and restrict network access to the TAS pod.
Original NVD description (English source)
A flaw was found in the TrustyAI Service (TAS) deployment. This vulnerability allows any pod on the cluster network to bypass authentication and directly access the TAS backend API. An attacker can exploit this to read, tamper with, or delete monitoring data and configurations, and inject arbitrary data into the service, potentially disrupting tenant operations.