CVE-2026-92982

HIGH 8.5

Ansible-operator-plugins: ansible operator plugins: arbitrary code execution via jinja2 template injection

CVSS Score

8.5

EPSS Score

0.0%

EPSS Percentile

0th

A flaw was found in Ansible Operator Plugins. A low-privileged Kubernetes user can exploit a Jinja2 template injection vulnerability by crafting malicious custom resource (CR) specification values. These values are processed by Ansible without proper sanitization, allowing embedded Jinja2 expressions to be executed within the operator pod. This can lead to arbitrary code execution and privilege escalation, granting the attacker control over the operator's service account with cluster-wide permissions.

CWE	CWE-1336
Vendor	red hat
Product	migration toolkit for applications 8
Published	Oct 15, 2026

Stay Ahead of the Next One

Get instant alerts for red hat migration toolkit for applications 8

Be the first to know when new high vulnerabilities affecting red hat migration toolkit for applications 8 are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

High

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Affected Versions

Red Hat / Migration Toolkit for Applications 8

All versions affected

Red Hat / Migration Toolkit for Containers

All versions affected

Red Hat / Migration Toolkit for Virtualization

All versions affected

Red Hat / OpenShift Service Mesh 3

All versions affected

Red Hat / Red Hat Advanced Cluster Management for Kubernetes 2

All versions affected

Red Hat / Red Hat Advanced Cluster Management for Kubernetes 2

All versions affected