8.5
Élevée
CVE-2026-92982 A flaw was found in Ansible Operator Plugins
Description
A flaw was found in Ansible Operator Plugins. A low-privileged Kubernetes user can exploit a Jinja2 template injection vulnerability by crafting malicious custom resource (CR) specification values. These values are processed by Ansible without proper sanitization, allowing embedded Jinja2 expressions to be executed within the operator pod. This can lead to arbitrary code execution and privilege escalation, granting the attacker control over the operator's service account with cluster-wide permissions.
Produits et versions touchés
| Produit | Versions touchées | Corrigé en |
|---|---|---|
| Migration Toolkit for Applications 8 | Versions non publiées | |
| Migration Toolkit for Containers | Versions non publiées | |
| Migration Toolkit for Virtualization | Versions non publiées | |
| OpenShift Service Mesh 3 | Versions non publiées | |
| Red Hat Advanced Cluster Management for Kubernetes 2 | Versions non publiées | |
| Red Hat Ansible Automation Platform 2 | Versions non publiées | |
| Red Hat OpenShift Container Platform 4 | Versions non publiées | |
| Red Hat OpenShift Virtualization 4 | Versions non publiées | |
| Red Hat OpenStack Platform 16.2 | Versions non publiées |
Afficher les 7 autres branches Masquer les 7 autres branches
| Produit | Versions touchées | Corrigé en |
|---|---|---|
| Red Hat OpenStack Platform 17.1 | Versions non publiées | |
| Red Hat OpenStack Platform 18.0 | Versions non publiées | |
| Service Telemetry Framework 1.5 | Versions non publiées | |
| Red Hat Ansible Automation Platform 2.6 1791840864 | premières → < 1791840864 | 1791840864 |
| Red Hat Ansible Automation Platform 2.7 1792138238 | premières → < 1792138238 | 1792138238 |
| Red Hat OpenShift Service Mesh 3.4 1789021200 | premières → < 1789021200 | 1789021200 |
| Red Hat OpenShift Container Platform 5 | Versions non publiées |
Références
- RHSA-2026:68695 access.redhat.com
- RHSA-2026:87120 access.redhat.com
- RHSA-2026:87124 access.redhat.com
- access.redhat.com access.redhat.com
- RHBZ#2522227 bugzilla.redhat.com
Chronologie
- Publiée
- Dernière modification
Autres CVE de Migration Toolkit for Applications 8
Les 64 CVE de Migration Toolkit for Applications 8 →
CVE-2026-114406
Ca-certificates: distrust emudhra intermediate ca certificates due to security concerns
6.8
Moyenne
CVE-2026-89091
Ansible-core: ansible-core: ansible-galaxy collection install symlink path escape allows arbitrary file write / code execution
8.8
Élevée
CVE-2026-13676
fast-uri versions 2.3.1 through 3.1.2 and 4.0.0 fail to canonicalize Unicode (IDN) hostnames for HTTP-family URLs
7.5
Élevée
CVE-2026-49851
Mistune is a Python Markdown parser with renderers and plugins
8.7
Élevée