CVE-2026-15063

Severity CVSS v4.0:

Pending analysis

Type:

CWE-306 Missing Authentication for Critical Function

Publication date:

08/07/2026

Last modified:

09/07/2026

Description

A flaw was found in the gorch service template, which is part of the trustyai-service-operator. Even when authentication is enabled, the gorch service exposes unproxied orchestrator and detector metrics ports. This allows any pod on the cluster network to directly access these ports, bypassing the kube-rbac-proxy and its authentication mechanisms. This could lead to unauthorized access to the orchestrator and detector metrics.

Impact

Vector 3.x

CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N CVSS v3.1 Severity and Metrics:

Base Score: 6.30 MEDIUM
Vector: CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N

Attack Vector (AV): Adjacent
Attack Complexity (AC): Low
Privileges Required (PR): Low
User Interaction (UI): None
Scope (S): Unchanged
Confidentiality (C): High
Integrity (I): Low
Availability (A): None

Base Score 3.x

6.30

Severity 3.x

MEDIUM

CVE-2026-15063

Description

Impact

References to Advisories, Solutions, and Tools