CVE-2026-92982CWE-1336

CVE-2026-92982

High · published October 15, 2026

CVSS v3.1
8.5
EPSS
0%
Percentile
39.9
In the wild
Unconfirmed
What it is

A flaw was found in Ansible Operator Plugins. A low-privileged Kubernetes user can exploit a Jinja2 template injection vulnerability by crafting malicious custom resource (CR) specification values. These values are processed by Ansible without proper sanitization, allowing embedded Jinja2 expressions to be executed within the operator pod. This can lead to arbitrary code execution and privilege escalation, granting the attacker control over the operator's service account with cluster-wide permissions.

The record
Technical detail
CVSS v3.1
8.5 · HIGH
Vector
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00472 · 39.9th percentile
Weakness
CWE-1336 · Improper Neutralization of Special Elements Used in a Template Engine
Published
2026-10-15T20:18Z
References (4)
https://access.redhat.com/errata/RHSA-2026:87120 · [email protected]https://access.redhat.com/errata/RHSA-2026:87124 · [email protected]https://access.redhat.com/security/cve/CVE-2026-92982 · [email protected]https://bugzilla.redhat.com/show_bug.cgi?id=2522227 · [email protected]
EPSS history
Timeline
  • 17 OCT 03:34Z
    EPSS moved — → 0%
    epss
  • 15 OCT 15:36Z
    Ansible-operator-plugins: ansible operator plugins: arbitrary code execution via jinja2 template injection
    cvelistv5
  • 15 OCT 15:36Z
    Ansible-operator-plugins: ansible operator plugins: arbitrary code execution via jinja2 template injection
    cvelistv5