Ansible Operator Plugins: Jinja2 Template Injection Enables ClusterWide PrivEsc
CVE-2026-92982 Published on October 15, 2026

Ansible-operator-plugins: ansible operator plugins: arbitrary code execution via jinja2 template injection
A flaw was found in Ansible Operator Plugins. A low-privileged Kubernetes user can exploit a Jinja2 template injection vulnerability by crafting malicious custom resource (CR) specification values. These values are processed by Ansible without proper sanitization, allowing embedded Jinja2 expressions to be executed within the operator pod. This can lead to arbitrary code execution and privilege escalation, granting the attacker control over the operator's service account with cluster-wide permissions.

NVD

Vulnerability Analysis

CVE-2026-92982 is exploitable with network access, and requires small amount of user privileges. This vulnerability is consided to have a high level of attack complexity. The potential impact of an exploit of this vulnerability is considered to be very high.

Attack Vector:
NETWORK
Attack Complexity:
HIGH
Privileges Required:
LOW
User Interaction:
NONE
Scope:
CHANGED
Confidentiality Impact:
HIGH
Integrity Impact:
HIGH
Availability Impact:
HIGH

Timeline

Reported to Red Hat.

Made public. 52 days later.

Weakness Type

CWE-1336

Products Associated with CVE-2026-92982

Want to know whenever a new CVE is published for Red Hat products? stack.watch will email you.

Red Hat Migration Toolkit Applications
 
Red Hat Rhmt
 
Red Hat Migration Toolkit Virtualization
 
Red Hat Service Mesh
 
Red Hat Acm
 
Red Hat Ansible Automation Platform
 
Red Hat Openshift
 
Red Hat Container Native Virtualization
 
Red Hat Openstack
 
Red Hat Stf
 

Affected Versions

Red Hat Migration Toolkit for Applications 8: Red Hat Migration Toolkit for Containers: Red Hat Migration Toolkit for Virtualization: Red Hat OpenShift Service Mesh 3: Red Hat Advanced Cluster Management for Kubernetes 2: Red Hat Advanced Cluster Management for Kubernetes 2: Red Hat Ansible Automation Platform 2: Red Hat Ansible Automation Platform 2: Red Hat Ansible Automation Platform 2: Red Hat Ansible Automation Platform 2: Red Hat Ansible Automation Platform 2: Red Hat Ansible Automation Platform 2: Red Hat Ansible Automation Platform 2: Red Hat Ansible Automation Platform 2: Red Hat Ansible Automation Platform 2: Red Hat Ansible Automation Platform 2: Red Hat Ansible Automation Platform 2: Red Hat Ansible Automation Platform 2: Red Hat Ansible Automation Platform 2: Red Hat Ansible Automation Platform 2: Red Hat Ansible Automation Platform 2: Red Hat Ansible Automation Platform 2: Red Hat OpenShift Container Platform 4: Red Hat OpenShift Container Platform 4: Red Hat OpenShift Container Platform 4: Red Hat OpenShift Virtualization 4: Red Hat OpenStack Platform 16.2: Red Hat OpenStack Platform 17.1: Red Hat OpenStack Platform 18.0: Red Hat Service Telemetry Framework 1.5: Red Hat Service Telemetry Framework 1.5: