Red Hat CVE-2026-92982 (CVSS 3.1 8.5 Important): Ansible Operator Plugins Jinja2 template injection — low-priv Kubernetes user can run code in the operator pod and inherit its cluster RBAC; mitigate with markUnsafe: true

Red Hat published CVE-2026-92982 on 15 October 2026 (public date 15 Oct 13:33 UTC) for Ansible Operator Plugins. A low-privileged Kubernetes user who can create or modify a custom resource can put Jinja2 expressions in CR spec values; Ansible evaluates those values inside the operator pod without proper sanitisation, so the attacker gets arbitrary code execution in that pod and can use the operator service account's cluster RBAC. Red Hat rates it Important, CVSS 3.1 8.5 (AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H), CWE-1336. The markUnsafe flag in Ansible Operator Plugins (used in Red Hat Ansible Automation Platform and OpenShift Container Platform) defaults to false, which is what allows the injection. Mitigation from Red Hat: set markUnsafe: true in watches.yaml for the affected operator so CR spec fields are not evaluated as templates, then restart the operator pod. Red Hat's product impact table was still listing affected OpenShift / AAP-family products with fix status under investigation at last check — do not invent package EVRs; follow the live CVE page for errata. No exploitation is stated. Primary: Red Hat CVE-2026-92982.

Product

Ansible Operator Plugins (Red Hat Ansible Automation Platform / OpenShift operator workloads)

Versions

See Red Hat CVE page for current affected product list (AAP, OpenShift Container Platform and related operator stacks). Fix packages: follow live errata on that page — status was under investigation for several products at last check.

CVSS

8.5 (CVSS 3.1 Important — Red Hat)

Exploited in Australia?

unknown

Patch to

Immediate: set markUnsafe: true in the affected operator's watches.yaml and restart the operator pod. Then apply Red Hat errata when published for your AAP/OpenShift stream. Limit who can create or edit custom resources that Ansible operators watch.

Primary: Red Hat — CVE-2026-92982 Ansible Operator Plugins Jinja2 template injection (public 15 Oct 2026) · Vendor: Red Hat Customer Portal — CVE-2026-92982 · CVE: CVE-2026-92982 · CVE.org — CVE-2026-92982

vulnerabilities cloud