Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-92982— Ansible-operator-plugins: ansible operator plugins: arbitrary code execution via jinja2 template injection

Quick assessment

Affected
Red Hat Migration Toolkit for Applications 8
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

发现 Ansible Operator 插件存在一个安全漏洞。低权限的 Kubernetes 用户可以利用 Jinja2 模板注入漏洞，通过构造恶意的自定义资源（CR）规范值进行攻击。Ansible 在处理这些值时未进行适当的消毒（sanitization），导致嵌入的 Jinja2 表达式在 Operator Pod 中得以执行。该漏洞可导致任意代码执行和权限提升，从而使攻击者能够控制具有集群范围权限的 Operator 服务账号，获取对集群的完全控制权。

CVSS 8.5 · High

Affected Version Matrix 31

VendorProduct Version RangeStatus
Red Hat Migration Toolkit for Applications 8 any affected
Red Hat Migration Toolkit for Containers any affected
Red Hat Migration Toolkit for Virtualization any affected
Red Hat OpenShift Service Mesh 3 any affected
Red Hat Red Hat Advanced Cluster Management for Kubernetes 2 any unaffected
any unaffected
Red Hat Red Hat Ansible Automation Platform 2 any affected
any affected
any affected
any affected
any affected
any affected
any affected
any affected
… +8 more rows
Red Hat Red Hat OpenShift Container Platform 4 any affected
any unaffected
any affected
Red Hat Red Hat OpenShift Virtualization 4 any unaffected
Red Hat Red Hat OpenStack Platform 16.2 any affected
Red Hat Red Hat OpenStack Platform 17.1 any affected
Red Hat Red Hat OpenStack Platform 18.0 any affected
Red Hat Service Telemetry Framework 1.5 any unaffected
any affected
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-92982

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
Ansible-operator-plugins: ansible operator plugins: arbitrary code execution via jinja2 template injection
Source: CVE Program / CVE List V5
Vulnerability Description
A flaw was found in Ansible Operator Plugins. A low-privileged Kubernetes user can exploit a Jinja2 template injection vulnerability by crafting malicious custom resource (CR) specification values. These values are processed by Ansible without proper sanitization, allowing embedded Jinja2 expressions to be executed within the operator pod. This can lead to arbitrary code execution and privilege escalation, granting the attacker control over the operator's service account with cluster-wide permissions.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
CWE-1336
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
Red Hat Migration Toolkit for Applications 8 - cpe:/a:redhat:migration_toolkit_applications:8
Red Hat Migration Toolkit for Containers - cpe:/a:redhat:rhmt:1
Red Hat Migration Toolkit for Virtualization - cpe:/a:redhat:migration_toolkit_virtualization:2
Red Hat OpenShift Service Mesh 3 - cpe:/a:redhat:service_mesh:3
Red Hat Red Hat Advanced Cluster Management for Kubernetes 2 - cpe:/a:redhat:acm:2
Red Hat Red Hat Advanced Cluster Management for Kubernetes 2 - cpe:/a:redhat:acm:2
Red Hat Red Hat Ansible Automation Platform 2 - cpe:/a:redhat:ansible_automation_platform:2
Red Hat Red Hat Ansible Automation Platform 2 - cpe:/a:redhat:ansible_automation_platform:2
Red Hat Red Hat Ansible Automation Platform 2 - cpe:/a:redhat:ansible_automation_platform:2
Red Hat Red Hat Ansible Automation Platform 2 - cpe:/a:redhat:ansible_automation_platform:2
Red Hat Red Hat Ansible Automation Platform 2 - cpe:/a:redhat:ansible_automation_platform:2
Red Hat Red Hat Ansible Automation Platform 2 - cpe:/a:redhat:ansible_automation_platform:2
Red Hat Red Hat Ansible Automation Platform 2 - cpe:/a:redhat:ansible_automation_platform:2
Red Hat Red Hat Ansible Automation Platform 2 - cpe:/a:redhat:ansible_automation_platform:2
Red Hat Red Hat Ansible Automation Platform 2 - cpe:/a:redhat:ansible_automation_platform:2
Red Hat Red Hat Ansible Automation Platform 2 - cpe:/a:redhat:ansible_automation_platform:2
Red Hat Red Hat Ansible Automation Platform 2 - cpe:/a:redhat:ansible_automation_platform:2
Red Hat Red Hat Ansible Automation Platform 2 - cpe:/a:redhat:ansible_automation_platform:2
Red Hat Red Hat Ansible Automation Platform 2 - cpe:/a:redhat:ansible_automation_platform:2
Red Hat Red Hat Ansible Automation Platform 2 - cpe:/a:redhat:ansible_automation_platform:2
Red Hat Red Hat Ansible Automation Platform 2 - cpe:/a:redhat:ansible_automation_platform:2
Red Hat Red Hat Ansible Automation Platform 2 - cpe:/a:redhat:ansible_automation_platform:2
Red Hat Red Hat OpenShift Container Platform 4 - cpe:/a:redhat:openshift:4
Red Hat Red Hat OpenShift Container Platform 4 - cpe:/a:redhat:openshift:4
Red Hat Red Hat OpenShift Container Platform 4 - cpe:/a:redhat:openshift:4
Red Hat Red Hat OpenShift Virtualization 4 - cpe:/a:redhat:container_native_virtualization:4
Red Hat Red Hat OpenStack Platform 16.2 - cpe:/a:redhat:openstack:16.2
Red Hat Red Hat OpenStack Platform 17.1 - cpe:/a:redhat:openstack:17.1
Red Hat Red Hat OpenStack Platform 18.0 - cpe:/a:redhat:openstack:18.0
Red Hat Service Telemetry Framework 1.5 - cpe:/a:redhat:stf:1.5

II. Public POCs for CVE-2026-92982

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-92982

请登录查看更多情报信息。

Vendor Advisories for CVE-2026-92982 (2)

Same Patch Batch · Red Hat · 2026-10-15 · 10 CVEs total

CVE-2026-85634 8.8 HIGH Wildfly-core: wildfly-core: deployer rbac role privilege escalation via path traversal in
CVE-2026-108334 7.4 HIGH Github.com/kuadrant/kuadrant-operator/internal/wasm: github.com/rh-api-management/rhcl-ope
CVE-2026-84823 7.1 HIGH Org.wildfly.core: wildfly: path traversal in take-snapshot discloses the server configurat
CVE-2026-110923 6.5 MEDIUM Openssh: openssh: sftp can write outside the destination directory from a server-supplied
CVE-2026-109131 5.4 MEDIUM Ansible-ui: ansible-ui: stored xss via unsafe javascript url scheme in hub collection modu
CVE-2026-110925 5.4 MEDIUM Openssh: openssh: '$' and '\' in a command-line username expand through %u
CVE-2026-110926 5.3 MEDIUM Openssh: openssh: shared lz77 compression dictionary leaks plaintext across channels
CVE-2026-110924 4.8 MEDIUM Openssh: openssh: gssapi delegated credentials can be stored after a failed authentication
CVE-2026-110927 4.3 MEDIUM Openssh: openssh: a compressed payload can expand past the maximum packet size

IV. Related Vulnerabilities

Same product: Migration Toolkit for Applications 8
Same vendor: Red Hat
Same weakness: CWE-1336

V. Comments for CVE-2026-92982

No comments yet

Leave a comment