TrustyAI Gorch Auth Bypass via Exposed Port 8032 (CVE-2026-15063)

Vulnerability Overview Vulnerability ID: CVE-2026-15063 Vulnerability Name: TrustyAI Service Operator: Gorch port bypass when auth IS enabled Status: NEW Priority: medium Severity: medium Reported Time: 2026-07-08 14:34 UTC Modified Time: 2026-07-08 14:44 UTC Scope of Impact Product: Security Response Component: vulnerability Hardware: All Operating System: Linux Target Milestone: Not specified Assigned To: Product Security Remediation Fixed Version: Not specified Environment: Not specified Closed At: Not specified Embargoed: Not specified Detailed Description Problem Description: - The Gorch service template ( ) continues to expose both the unproxyed orchestrator ports (https://8032-8032) and the built-in detector metrics ports (8088-8080) alongside the proxy port, even when authentication (auth) is enabled. - The root cause lies in , which configures to point to the (Service DNS). Architecturally, this requires port 8032 to remain open on the Service. - Any Pod within the cluster network can bypass by directly accessing port 8032. - In contrast, NemoGuardrails correctly switches to proxy-only ports when auth is enabled. EvalHub always deploys using with (loopback binding), demonstrating that "auth-by-default" is architecturally feasible. - There are no NetworkPolicies present in the codebase (grep returned zero results). Bypass Method: 1. When auth is enabled, Gorch ports are bypassed via annotations. 2. is deployed on port 8443. 3. Ports 8032 (orchestrator) and 8080 (detector metrics) remain exposed on the Service. 4. Any Pod directly accesses port 8032, bypassing . POC Code Additional Information Attachments: None Comments: Login required to comment or make changes to this bug. Summary This vulnerability involves the Gorch service within TrustyAI Service Operator. When authentication is enabled, port 8032 remains exposed, allowing an attacker to bypass . The remediation plan has not yet been specified, and further security response measures are required.

Goal Reached Thanks to every supporter — we hit 100%!

TrustyAI Gorch Auth Bypass via Exposed Port 8032 (CVE-2026-15063)