Skip to content
Fencer Vulns
high 8.5

CVE-2026-92982 json

Ansible-operator-plugins: ansible operator plugins: arbitrary code execution via jinja2 template injection

published 2026-10-15 25 d ago modified 2026-10-30 10 d ago also EUVD-2026-102157

cvss
8.5
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
0.5%
EPSS 0.5% chance of exploitation in 30 days, percentile 41%
public exploits
0
none known

Summary

A flaw was found in Ansible Operator Plugins. A low-privileged Kubernetes user can exploit a Jinja2 template injection vulnerability by crafting malicious custom resource (CR) specification values. These values are processed by Ansible without proper sanitization, allowing embedded Jinja2 expressions to be executed within the operator pod. This can lead to arbitrary code execution and privilege escalation, granting the attacker control over the operator's service account with cluster-wide permissions.

Patch / fix

  • Red Hat Red Hat Ansible Automation Platform 2.6 1791840864
  • Red Hat Red Hat Ansible Automation Platform 2.7 1792138238
  • Red Hat Red Hat OpenShift Service Mesh 3.4 1789021200

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2026-92982 updated cvss 8.5

ansible-operator-plugins: Ansible Operator Plugins: Arbitrary Code Execution via Jinja2 Template Injection

  • Red Hat Migration Toolkit for Applications 8 mta/mta-rhel9-operator Red Hat Migration Toolkit for Containers rhmtc/openshift-migration-rhel8-operator Red Hat Migration Toolkit for Virtualization migration-toolkit-virtualization/mtv-rhel9-operator Red Hat Ansible Automation Platform 2 ansible-automation-platform-26/hub-rhel9-operator, ansible-automation-platform-27/hub-rhel9-operator, ansible-automation-platform-26/gateway-rhel9-operator, ansible-automation-platform-27/gateway-rhel9-operator, ansible-automation-platform-26/controller-rhel9-operator, ansible-automation-platform-27/controller-rhel9-operator, +8 more Red Hat OpenShift Container Platform 4 openshift4/ose-operator-sdk-rhel9, openshift4/ose-ansible-rhel9-operator Red Hat OpenShift Container Platform 5 openshift5/ose-ansible-rhel9-operator
    +4 more products
    Red Hat OpenStack Platform 16.2 rhosp-rhel8/osp-director-operator-bundle Red Hat OpenStack Platform 17.1 rhosp-rhel9/osp-director-operator-bundle Red Hat OpenStack Platform 18.0 rhoso-operators/openstack-operator-bundle Red Hat Service Telemetry Framework 1.5 stf/smart-gateway-rhel9-operator
    affected: workaround, no fix available
  • Red Hat Ansible Automation Platform 2.6 ansible-automation-platform-26/lightspeed-rhel9-operator 1791840864
    fixed: vendor fix RHSA-2026:87120
  • Red Hat Ansible Automation Platform 2.7 ansible-automation-platform-27/lightspeed-rhel9-operator 1792138238
    fixed: vendor fix RHSA-2026:87124
  • Red Hat OpenShift Service Mesh 3.4 openshift-service-mesh/kiali-rhel9-operator 1789021200
    fixed: vendor fix RHSA-2026:68695
  • Red Hat Advanced Cluster Management for Kubernetes 2 rhacm2/submariner-rhel9-operator, rhacm2/submariner-operator-bundle Red Hat Ansible Automation Platform 2.6 ansible-automation-platform-26/hub-rhel9 1791947385, ansible-automation-platform-26/gateway-rhel9 1791971533, ansible-automation-platform-26/hub-web-rhel9 1791952205, ansible-automation-platform-26/receptor-rhel9 1791968536, ansible-automation-platform-26/mcp-tools-rhel9 1791941340, ansible-automation-platform-26/controller-rhel9 1791947602, +24 more Red Hat Ansible Automation Platform 2.7 ansible-automation-platform-27/hub-rhel9 1792388670, ansible-automation-platform-27/gateway-rhel9 1792429216, ansible-automation-platform-27/hub-web-rhel9 1792394496, ansible-automation-platform-27/receptor-rhel9 1792139928, ansible-automation-platform-27/mcp-tools-rhel9 1792425046, ansible-automation-platform-27/controller-rhel9 1792389457, +26 more Red Hat OpenShift Container Platform 4 openshift4/ose-helm-rhel9-operator Red Hat OpenShift Container Platform 5 openshift5/ose-helm-rhel9-operator Red Hat OpenShift Service Mesh 3.4 openshift-service-mesh/kiali-rhel9 1789021319, openshift-service-mesh/kiali-ossmc-rhel9 1789475294, openshift-service-mesh/kiali-operator-bundle 1789478366
    +2 more products
    Red Hat OpenShift Virtualization 4 container-native-virtualization/cluster-network-addons-operator-rhel9 Red Hat Service Telemetry Framework 1.5 stf/service-telemetry-rhel9-operator
    not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation
none
Automatable
no
Technical impact
total
Assessed
24 d ago

Exploit prediction

0.47% chance of exploitation in the next 30 days, higher than 41% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
CNA 3.1 8.5 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H

Affected products

  • Red Hat Red Hat Ansible Automation Platform 2.6
  • Red Hat Red Hat Ansible Automation Platform 2.7
  • Red Hat Red Hat OpenShift Service Mesh 3.4
  • Red Hat Migration Toolkit for Applications 8
  • Red Hat Migration Toolkit for Containers
  • Red Hat Migration Toolkit for Virtualization
  • Red Hat Red Hat Advanced Cluster Management for Kubernetes 2
  • Red Hat Red Hat Ansible Automation Platform 2
  • Red Hat Red Hat OpenShift Container Platform 4
  • Red Hat Red Hat OpenShift Container Platform 5
  • Red Hat Red Hat OpenShift Virtualization 4
  • Red Hat Red Hat OpenStack Platform 16.2
  • Red Hat Red Hat OpenStack Platform 17.1
  • Red Hat Red Hat OpenStack Platform 18.0
  • Red Hat Service Telemetry Framework 1.5

Classification

Weakness
  • CWE-1336 Improper Neutralization of Special Elements Used in a Template Engine

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.