CVE-2026-92982: Ansible Operator Jinja2 template injection

CVE-2026-92982 · Severity: high · CVSS 8.5 · Published 2026-10-15

Ansible Operator Plugins, used to manage Kubernetes applications, contain a template injection flaw that allows low-privileged Kubernetes users to inject malicious code through custom resource specifications. An attacker exploiting this vulnerability can execute arbitrary code within the operator pod and escalate privileges to gain full cluster-wide control. This enables attackers to compromise all workloads and data within the Kubernetes cluster.

Technologies: Red Hat Ansible Automation Platform, Red Hat OpenShift Container Platform. Vendors: Red Hat.

Quick answers

Is CVE-2026-92982 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-92982 being exploited in the wild.
How severe is CVE-2026-92982?
High severity, with a CVSS score of 8.5, published 15 October 2026.
Which products and versions are affected?
Red Hat Ansible Automation Platform; Red Hat OpenShift Container Platform; Ansible Operator.
Is there a fix for CVE-2026-92982?
No fixed version is recorded yet. Configure the Ansible Operator watch to explicitly mark custom resource (CR) spec values as unsafe by setting `markUnsafe: true` in the `watches.yaml` configuration file for the affected operator. A restart of the operator pod may be required for the changes to take effect.</anigation> <parameter name="timeline">[ { "kind": "disclosed", "at": "2026-10-15" } ] If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-92982 attacked?
It is attacked over the network.
Am I affected by CVE-2026-92982?
Check whether you run Red Hat Ansible Automation Platform, Red Hat OpenShift Container Platform or Ansible Operator. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Configure the Ansible Operator watch to explicitly mark custom resource (CR) spec values as unsafe by setting `markUnsafe: true` in the `watches.yaml` configuration file for the affected operator. A restart of the operator pod may be required for the changes to take effect.</anigation> <parameter name="timeline">[ { "kind": "disclosed", "at": "2026-10-15" } ]

Technical details

The Ansible Operator Plugins fail to properly sanitize custom resource (CR) specification values before processing them with Jinja2 templating. A low-privileged Kubernetes user with CR creation/modification permissions can inject Jinja2 expressions that are executed in the operator pod context. This leads to arbitrary code execution under the operator's service account identity, which typically has cluster-wide RBAC permissions, enabling privilege escalation and cluster compromise.

Affected products

  • Red Hat Ansible Automation Platform
  • Red Hat OpenShift Container Platform
  • Ansible Operator

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.