CVE-2026-83494: Training-operator: pytorchjob validateupdate casts oldjob from newobj, bypassing managedby immutability (asvs v5.1.3; upstream bug)

Published Nov 6, 2026

Updated

A flaw was found in the training-operator. An incorrect object casting in the PyTorchJob ValidateUpdate webhook allows users to bypass an immutability check. This vulnerability could enable users to detach a queued job from its quota management system or hijack a running job's controller ownership. The primary impact is a Denial of Service (DoS) condition.

Event History

Nov 6, 2026

CVE Published

via MITRE·06:39 AM

Data Sourced

via MITRE·06:39 AM

DescriptionWeakness

Frequently Asked Questions

What level of access is described for exploitation?

The available information identifies users as the actors who could exploit the issue, but it does not specify required roles, permissions, authentication requirements, or whether unauthenticated exploitation is possible.

What operational outcomes should be investigated when triaging this issue?

Investigate whether queued PyTorchJobs can be detached from quota management and whether running jobs can have their controller ownership altered. The stated primary impact is denial of service.

CVE-2026-83494: Training-operator: pytorchjob validateupdate casts oldjob from newobj, bypassing managedby immutability (asvs v5.1.3; upstream bug)

Event History

Frequently Asked Questions

What level of access is described for exploitation?

What operational outcomes should be investigated when triaging this issue?

Company

Resources

Contact

Frequently Asked Questions

What level of access is described for exploitation?

What operational outcomes should be investigated when triaging this issue?