CVE-2026-92982: Ansible-operator-plugins: ansible operator plugins: arbitrary code execution via jinja2 template injection

Severity: high (CVSS 8.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.5% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-10-15 · updated 2026-10-30
Weakness: CWE-1336

Description

A flaw was found in Ansible Operator Plugins. A low-privileged Kubernetes user can exploit a Jinja2 template injection vulnerability by crafting malicious custom resource (CR) specification values. These values are processed by Ansible without proper sanitization, allowing embedded Jinja2 expressions to be executed within the operator pod. This can lead to arbitrary code execution and privilege escalation, granting the attacker control over the operator's service account with cluster-wide permissions.

Affected products

Red Hat Migration Toolkit for Applications 8: all versions
Red Hat Migration Toolkit for Containers: all versions
Red Hat Migration Toolkit for Virtualization: all versions
Red Hat OpenShift Container Platform 4.18: all versions
Red Hat Ansible Automation Platform 2: all versions
Red Hat Ansible Automation Platform 2.6: all versions — fixed in 1791840864
Red Hat Ansible Automation Platform 2.7: all versions — fixed in 1792138238
Red Hat OpenShift Container Platform 5: all versions
Red Hat OpenShift Service Mesh 3.4: all versions — fixed in 1789021200
Red Hat OpenStack Platform 16.2: all versions
Red Hat OpenStack Platform 17.1: all versions
Red Hat OpenStack Platform 18.0: all versions
Red Hat Service Telemetry Framework 1.5: all versions

How to fix

Upgrade to a fixed version: Red Hat Ansible Automation Platform 2.6 1791840864; Red Hat Ansible Automation Platform 2.7 1792138238; Red Hat OpenShift Service Mesh 3.4 1789021200. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2026-92982 or the next vulnerability affects your stack