CVE-2026-92982: high-severity vulnerability in Red Hat Migration Toolkit for Applications 8
Ansible-operator-plugins: ansible operator plugins: arbitrary code execution via jinja2 template injection
Published · Updated
Follow this CVE+ Monitor Red Hat OpenShift Container Platform+ Monitor Red Hat Ansible Automation Platform
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
21Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 8.5epss 0.5%
A flaw was found in Ansible Operator Plugins. A low-privileged Kubernetes user can exploit a Jinja2 template injection vulnerability by crafting malicious custom resource (CR) specification values. These values are processed by Ansible without proper sanitization, allowing embedded Jinja2 expressions to be executed within the operator pod. This can lead to arbitrary code execution and privilege escalation, granting the attacker control over the operator's service account with cluster-wide permissions.
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H
Affected products
Red Hat · Migration Toolkit for Applications 8Red Hat · Migration Toolkit for ContainersRed Hat · Migration Toolkit for VirtualizationRed Hat · Red Hat Advanced Cluster Management for Kubernetes 2Red Hat · Red Hat Ansible Automation Platform 2Red Hat · Red Hat Ansible Automation Platform 2.6Red Hat · Red Hat Ansible Automation Platform 2.7Red Hat · Red Hat OpenShift Container Platform 4Red Hat · Red Hat OpenShift Container Platform 5Red Hat · Red Hat OpenShift Service Mesh 3.4Red Hat · Red Hat OpenShift Virtualization 4Red Hat · Red Hat OpenStack Platform 16.2Red Hat · Red Hat OpenStack Platform 17.1Red Hat · Red Hat OpenStack Platform 18.0Red Hat · Service Telemetry Framework 1.5Related CVEs — Red Hat Migration Toolkit for Applications 8
In the same product, most dangerous first.
CVE-2024-11831MEDIUMNpm-serialize-javascript: cross-site scripting (xss) in serialize-javascriptEPSS 1.1%CVE-2026-89091HIGHAnsible-core: ansible-core: ansible-galaxy collection install symlink path escape allows arbitrary file write / code executionEPSS 0.5%CVE-2026-11332HIGHAnsible-core: argument injection in ansible-galaxy role install leads to arbitrary code executionEPSS 0.2%