8.5
High
CVE-2026-92982 A flaw was found in Ansible Operator Plugins
Description
A flaw was found in Ansible Operator Plugins. A low-privileged Kubernetes user can exploit a Jinja2 template injection vulnerability by crafting malicious custom resource (CR) specification values. These values are processed by Ansible without proper sanitization, allowing embedded Jinja2 expressions to be executed within the operator pod. This can lead to arbitrary code execution and privilege escalation, granting the attacker control over the operator's service account with cluster-wide permissions.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| Migration Toolkit for Applications 8 | Versions not published | |
| Migration Toolkit for Containers | Versions not published | |
| Migration Toolkit for Virtualization | Versions not published | |
| OpenShift Service Mesh 3 | Versions not published | |
| Red Hat Advanced Cluster Management for Kubernetes 2 | Versions not published | |
| Red Hat Ansible Automation Platform 2 | Versions not published | |
| Red Hat OpenShift Container Platform 4 | Versions not published | |
| Red Hat OpenShift Virtualization 4 | Versions not published | |
| Red Hat OpenStack Platform 16.2 | Versions not published |
Show the 7 other branches Hide the 7 other branches
| Product | Affected versions | Fixed in |
|---|---|---|
| Red Hat OpenStack Platform 17.1 | Versions not published | |
| Red Hat OpenStack Platform 18.0 | Versions not published | |
| Service Telemetry Framework 1.5 | Versions not published | |
| Red Hat Ansible Automation Platform 2.6 1791840864 | earliest → < 1791840864 | 1791840864 |
| Red Hat Ansible Automation Platform 2.7 1792138238 | earliest → < 1792138238 | 1792138238 |
| Red Hat OpenShift Service Mesh 3.4 1789021200 | earliest → < 1789021200 | 1789021200 |
| Red Hat OpenShift Container Platform 5 | Versions not published |
References
- RHSA-2026:68695 access.redhat.com
- RHSA-2026:87120 access.redhat.com
- RHSA-2026:87124 access.redhat.com
- access.redhat.com access.redhat.com
- RHBZ#2522227 bugzilla.redhat.com
Timeline
- Published
- Last modified
Other CVEs of Migration Toolkit for Applications 8
The 64 CVEs of Migration Toolkit for Applications 8 →
CVE-2026-114406
Ca-certificates: distrust emudhra intermediate ca certificates due to security concerns
6.8
Medium
CVE-2026-89091
Ansible-core: ansible-core: ansible-galaxy collection install symlink path escape allows arbitrary file write / code execution
8.8
High
CVE-2026-13676
fast-uri versions 2.3.1 through 3.1.2 and 4.0.0 fail to canonicalize Unicode (IDN) hostnames for HTTP-family URLs
7.5
High
CVE-2026-49851
Mistune is a Python Markdown parser with renderers and plugins
8.7
High