Description
A flaw was found in Ansible Operator Plugins. A low-privileged Kubernetes user can exploit a Jinja2 template injection vulnerability by crafting malicious custom resource (CR) specification values. These values are processed by Ansible without proper sanitization, allowing embedded Jinja2 expressions to be executed within the operator pod. This can lead to arbitrary code execution and privilege escalation, granting the attacker control over the operator's service account with cluster-wide permissions.
Published: 2026-10-15
Score: 8.5 High
EPSS: n/a
KEV: No
Impact: n/a
Action: n/a
AI Analysis

No analysis available yet.

Remediation

Vendor Workaround

To mitigate this vulnerability, configure the Ansible Operator watch to explicitly mark custom resource (CR) spec values as unsafe. This can be achieved by setting `markUnsafe: true` in the `watches.yaml` configuration for the affected operator. This action prevents Jinja2 template injection by ensuring CR spec fields are not evaluated as templates. A restart of the operator pod may be required for the changes to take effect.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Thu, 15 Oct 2026 16:00:00 +0000

Type Values Removed Values Added
Description A flaw was found in Ansible Operator Plugins. A low-privileged Kubernetes user can exploit a Jinja2 template injection vulnerability by crafting malicious custom resource (CR) specification values. These values are processed by Ansible without proper sanitization, allowing embedded Jinja2 expressions to be executed within the operator pod. This can lead to arbitrary code execution and privilege escalation, granting the attacker control over the operator's service account with cluster-wide permissions.
Title Ansible-operator-plugins: ansible operator plugins: arbitrary code execution via jinja2 template injection
First Time appeared Redhat
Redhat acm
Redhat ansible Automation Platform
Redhat container Native Virtualization
Redhat migration Toolkit Applications
Redhat migration Toolkit Virtualization
Redhat openshift
Redhat openstack
Redhat rhmt
Redhat service Mesh
Redhat stf
Weaknesses CWE-1336
CPEs cpe:/a:redhat:acm:2
cpe:/a:redhat:ansible_automation_platform:2
cpe:/a:redhat:container_native_virtualization:4
cpe:/a:redhat:migration_toolkit_applications:8
cpe:/a:redhat:migration_toolkit_virtualization:2
cpe:/a:redhat:openshift:4
cpe:/a:redhat:openstack:16.2
cpe:/a:redhat:openstack:17.1
cpe:/a:redhat:openstack:18.0
cpe:/a:redhat:rhmt:1
cpe:/a:redhat:service_mesh:3
cpe:/a:redhat:stf:1.5
Vendors & Products Redhat
Redhat acm
Redhat ansible Automation Platform
Redhat container Native Virtualization
Redhat migration Toolkit Applications
Redhat migration Toolkit Virtualization
Redhat openshift
Redhat openstack
Redhat rhmt
Redhat service Mesh
Redhat stf
References
Metrics cvssV3_1

{'score': 8.5, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H'}

Subscriptions

Redhat Acm Ansible Automation Platform Container Native Virtualization Migration Toolkit Applications Migration Toolkit Virtualization Openshift Openstack Rhmt Service Mesh Stf
cve-icon MITRE

Status: PUBLISHED

Assigner: redhat

Published:

Updated: 2026-10-15T15:36:57.191Z

Reserved: 2026-09-17T13:53:53.998Z

Link: CVE-2026-92982

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Awaiting Analysis

Published: 2026-10-15T16:18:23.657

Modified: 2026-10-15T16:33:26.290

Link: CVE-2026-92982

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

No data.

Weaknesses
  • CWE-1336

    Improper Neutralization of Special Elements Used in a Template Engine