CVE-2026-92982
8.5HighPublished 15 Oct 2026 · NVD status: Awaiting Analysis · AI triage by gemini-3.8-flash
- Attack vector
- Network
- Complexity
- High
- Privileges needed
- Low
- User interaction
- None
- Impact
- Full C/I/A compromise
- Weakness
- CWE-1336
Impact
A low-privileged Kubernetes user can execute arbitrary code inside the operator pod and take over its service account, potentially escalating to cluster-wide control. The attacker needs valid credentials with permissions to create or update Custom Resources managed by the operator.
Root cause
The Ansible Operator Plugin processes Custom Resource specification values without sanitization, leading to server-side Jinja2 template injection inside the operator.
Affected systems
Versions not listed — check the vendor advisory.
CVSS v3.1 · CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H
Fix & remediation
Upgrade the Ansible Operator Plugin or the affected operator once patched versions are published by Red Hat; as an interim mitigation, restrict Kubernetes RBAC permissions to prevent untrusted users from creating or modifying Custom Resources handled by Ansible-based operators.
AI-suggested. Run it in staging first and check it against the vendor advisory. Why?
NVD description
A flaw was found in Ansible Operator Plugins. A low-privileged Kubernetes user can exploit a Jinja2 template injection vulnerability by crafting malicious custom resource (CR) specification values. These values are processed by Ansible without proper sanitization, allowing embedded Jinja2 expressions to be executed within the operator pod. This can lead to arbitrary code execution and privilege escalation, granting the attacker control over the operator's service account with cluster-wide permissions.