Trainer: trainer: trainjob env passthrough enables valuefrom.secretkeyref injection for namespace secret exfiltration

Overview

A flaw was found in the Trainer v2 TrainJob API. A user with permissions to create TrainJobs can exploit this by injecting valueFrom.secretKeyRef into environment variable definitions. This allows them to read and exfiltrate sensitive information (secrets) from the namespace, leading to a privilege escalation. This occurs when the TrainJob Role-Based Access Control (RBAC) is broader than the Secret read RBAC.

Affected

• rhoai/odh-trainer-rhel9

Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.

Workarounds

To mitigate this vulnerability, ensure that the Role-Based Access Control (RBAC) for users creating TrainJobs is aligned with their Secret read permissions. Alternatively, restrict the valueFrom.secretKeyRef field within the validating webhook to an allowlist of permitted secret names. Review and adjust RBAC policies to prevent users from creating TrainJobs with broader access to Secrets than intended.