Jinja2 template injection in Ansible Operator Plugins runs code
Priority LOW 39CWE-1336Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- High
- Impact type
- Code execution
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Partial Red Hat: 3 fixed, 10 without a fix
Attack profile from CVSS 3.1 · CNA. Fix status from CNA and Red Hat. Impact type from CWE-1336.
Summary
Red Hat Ansible Operator Plugins is affected by a Jinja2 template injection flaw (CWE-1336). Ansible processes custom resource specification values without sanitization, so embedded Jinja2 expressions run inside the operator pod. A low-privileged Kubernetes user who crafts malicious custom resource values can execute arbitrary code and take control of the operator's service account, which holds cluster-wide permissions.
Written with Claude Haiku 5.5 from the sources below · 2026-10-30
Description from the CNA
A flaw was found in Ansible Operator Plugins. A low-privileged Kubernetes user can exploit a Jinja2 template injection vulnerability by crafting malicious custom resource (CR) specification values. These values are processed by Ansible without proper sanitization, allowing embedded Jinja2 expressions to be executed within the operator pod. This can lead to arbitrary code execution and privilege escalation, granting the attacker control over the operator's service account with cluster-wide permissions.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00472 41st percentileScored 2026-11-07
Fix Partial Red Hat: 3 advisoriesRed Hat: 3 fixed, 10 without a fix
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Red Hat | Red Hat Ansible Automation Platform 2.6 | — | 1791840864 | Patch available | CNA |
| Red Hat | Red Hat Ansible Automation Platform 2.7 | — | 1792138238 | Patch available | CNA |
| Red Hat | Red Hat OpenShift Service Mesh 3.4 | — | 1789021200 | Patch available | CNA |
| Red Hat | Migration Toolkit for Applications 8 | — | — | No fix listed | CNA |
| Red Hat | Migration Toolkit for Containers | — | — | No fix listed | CNA |
| Red Hat | Migration Toolkit for Virtualization | — | — | No fix listed | CNA |
| Red Hat | Red Hat Advanced Cluster Management for Kubernetes 2 | — | — | Not affected | CNA |
| Red Hat | Red Hat Advanced Cluster Management for Kubernetes 2 | — | — | Not affected | CNA |
| Red Hat | Red Hat Ansible Automation Platform 2 | — | — | No fix listed | CNA |
| Red Hat | Red Hat Ansible Automation Platform 2 | — | — | No fix listed | CNA |
| Red Hat | Red Hat Ansible Automation Platform 2 | — | — | No fix listed | CNA |
| Red Hat | Red Hat Ansible Automation Platform 2 | — | — | No fix listed | CNA |
| Red Hat | Red Hat Ansible Automation Platform 2 | — | — | No fix listed | CNA |
| Red Hat | Red Hat Ansible Automation Platform 2 | — | — | No fix listed | CNA |
| Red Hat | Red Hat Ansible Automation Platform 2 | — | — | No fix listed | CNA |
| Red Hat | Red Hat Ansible Automation Platform 2 | — | — | No fix listed | CNA |
| Red Hat | Red Hat Ansible Automation Platform 2 | — | — | No fix listed | CNA |
| Red Hat | Red Hat Ansible Automation Platform 2 | — | — | No fix listed | CNA |
| Red Hat | Red Hat Ansible Automation Platform 2 | — | — | No fix listed | CNA |
| Red Hat | Red Hat Ansible Automation Platform 2 | — | — | No fix listed | CNA |
| Red Hat | Red Hat Ansible Automation Platform 2 | — | — | No fix listed | CNA |
| Red Hat | Red Hat Ansible Automation Platform 2 | — | — | No fix listed | CNA |
| Red Hat | Red Hat OpenShift Container Platform 4 | — | — | No fix listed | CNA |
| Red Hat | Red Hat OpenShift Container Platform 4 | — | — | Not affected | CNA |
| Red Hat | Red Hat OpenShift Container Platform 4 | — | — | No fix listed | CNA |
| Red Hat | Red Hat OpenShift Container Platform 5 | — | — | No fix listed | CNA |
| Red Hat | Red Hat OpenShift Container Platform 5 | — | — | Not affected | CNA |
| Red Hat | Red Hat OpenShift Virtualization 4 | — | — | Not affected | CNA |
| Red Hat | Red Hat OpenStack Platform 16.2 | — | — | No fix listed | CNA |
| Red Hat | Red Hat OpenStack Platform 17.1 | — | — | No fix listed | CNA |
| Red Hat | Red Hat OpenStack Platform 18.0 | — | — | No fix listed | CNA |
| Red Hat | Service Telemetry Framework 1.5 | — | — | Not affected | CNA |
| Red Hat | Service Telemetry Framework 1.5 | — | — | No fix listed | CNA |
- Red Hat Ansible Automation Platform 2.6 VendorRed Hat Affected — Fixed in 1791840864 Patch available CNA
- Red Hat Ansible Automation Platform 2.7 VendorRed Hat Affected — Fixed in 1792138238 Patch available CNA
- Red Hat OpenShift Service Mesh 3.4 VendorRed Hat Affected — Fixed in 1789021200 Patch available CNA
- Migration Toolkit for Applications 8 VendorRed Hat Affected — Fixed in — No fix listed CNA
- Migration Toolkit for Containers VendorRed Hat Affected — Fixed in — No fix listed CNA
- Migration Toolkit for Virtualization VendorRed Hat Affected — Fixed in — No fix listed CNA
- Red Hat Advanced Cluster Management for Kubernetes 2 VendorRed Hat Affected — Fixed in — Not affected CNA
- Red Hat Advanced Cluster Management for Kubernetes 2 VendorRed Hat Affected — Fixed in — Not affected CNA
- Red Hat Ansible Automation Platform 2 VendorRed Hat Affected — Fixed in — No fix listed CNA
- Red Hat Ansible Automation Platform 2 VendorRed Hat Affected — Fixed in — No fix listed CNA
- Red Hat Ansible Automation Platform 2 VendorRed Hat Affected — Fixed in — No fix listed CNA
- Red Hat Ansible Automation Platform 2 VendorRed Hat Affected — Fixed in — No fix listed CNA
- Red Hat Ansible Automation Platform 2 VendorRed Hat Affected — Fixed in — No fix listed CNA
- Red Hat Ansible Automation Platform 2 VendorRed Hat Affected — Fixed in — No fix listed CNA
- Red Hat Ansible Automation Platform 2 VendorRed Hat Affected — Fixed in — No fix listed CNA
- Red Hat Ansible Automation Platform 2 VendorRed Hat Affected — Fixed in — No fix listed CNA
- Red Hat Ansible Automation Platform 2 VendorRed Hat Affected — Fixed in — No fix listed CNA
- Red Hat Ansible Automation Platform 2 VendorRed Hat Affected — Fixed in — No fix listed CNA
- Red Hat Ansible Automation Platform 2 VendorRed Hat Affected — Fixed in — No fix listed CNA
- Red Hat Ansible Automation Platform 2 VendorRed Hat Affected — Fixed in — No fix listed CNA
- Red Hat Ansible Automation Platform 2 VendorRed Hat Affected — Fixed in — No fix listed CNA
- Red Hat Ansible Automation Platform 2 VendorRed Hat Affected — Fixed in — No fix listed CNA
- Red Hat OpenShift Container Platform 4 VendorRed Hat Affected — Fixed in — No fix listed CNA
- Red Hat OpenShift Container Platform 4 VendorRed Hat Affected — Fixed in — Not affected CNA
- Red Hat OpenShift Container Platform 4 VendorRed Hat Affected — Fixed in — No fix listed CNA
- Red Hat OpenShift Container Platform 5 VendorRed Hat Affected — Fixed in — No fix listed CNA
- Red Hat OpenShift Container Platform 5 VendorRed Hat Affected — Fixed in — Not affected CNA
- Red Hat OpenShift Virtualization 4 VendorRed Hat Affected — Fixed in — Not affected CNA
- Red Hat OpenStack Platform 16.2 VendorRed Hat Affected — Fixed in — No fix listed CNA
- Red Hat OpenStack Platform 17.1 VendorRed Hat Affected — Fixed in — No fix listed CNA
- Red Hat OpenStack Platform 18.0 VendorRed Hat Affected — Fixed in — No fix listed CNA
- Service Telemetry Framework 1.5 VendorRed Hat Affected — Fixed in — Not affected CNA
- Service Telemetry Framework 1.5 VendorRed Hat Affected — Fixed in — No fix listed CNA
CPE names CNA · 15
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:/a:redhat:ansible_automation_platform:2.6::el9 | 2.6 | — | Red Hat |
| cpe:/a:redhat:ansible_automation_platform:2.7::el9 | 2.7 | — | Red Hat |
| cpe:/a:redhat:service_mesh:3.4::el9 | 3.4 | — | Red Hat |
| cpe:/a:redhat:migration_toolkit_applications:8 | 8 | — | Red Hat |
| cpe:/a:redhat:rhmt:1 | 1 | — | Red Hat |
| cpe:/a:redhat:migration_toolkit_virtualization:2 | 2 | — | Red Hat |
| cpe:/a:redhat:acm:2 | 2 | — | Red Hat |
| cpe:/a:redhat:ansible_automation_platform:2 | 2 | — | Red Hat |
| cpe:/a:redhat:openshift:4 | 4 | — | Red Hat |
| cpe:/a:redhat:openshift:5 | 5 | — | Red Hat |
- cpe:/a:redhat:ansible_automation_platform:2.6::el9 Versions 2.6 — ·Red Hat
- cpe:/a:redhat:ansible_automation_platform:2.7::el9 Versions 2.7 — ·Red Hat
- cpe:/a:redhat:service_mesh:3.4::el9 Versions 3.4 — ·Red Hat
- cpe:/a:redhat:migration_toolkit_applications:8 Versions 8 — ·Red Hat
- cpe:/a:redhat:rhmt:1 Versions 1 — ·Red Hat
- cpe:/a:redhat:migration_toolkit_virtualization:2 Versions 2 — ·Red Hat
- cpe:/a:redhat:acm:2 Versions 2 — ·Red Hat
- cpe:/a:redhat:ansible_automation_platform:2 Versions 2 — ·Red Hat
- cpe:/a:redhat:openshift:4 Versions 4 — ·Red Hat
- cpe:/a:redhat:openshift:5 Versions 5 — ·Red Hat
Remediation
Fixed in 1791840864 for Red Hat Ansible Automation Platform 2.6 (RHSA-2026:87120), in 1792138238 for Red Hat Ansible Automation Platform 2.7 (RHSA-2026:87124), and in 1789021200 for Red Hat OpenShift Service Mesh 3.4 (RHSA-2026:68695). The sources list no fixed version for Migration Toolkit for Applications 8, Migration Toolkit for Containers, Migration Toolkit for Virtualization and Red Hat Ansible Automation Platform 2.
Written with Claude Haiku 5.5 from the sources below · 2026-10-30
Red Hat 3 advisories
- RHSA-2026:87124 Released 2026-10-21 · Red Hat rating CriticalRed Hat Ansible Automation Platform 2.7 Container Release Update
- Red Hat Ansible Automation Platform 2.7 registry.redhat.io/ansible-automation-platform-27/de-supported-rhel9, registry.redhat.io/ansible-automation-platform-27/eda-controller-rhel9, registry.redhat.io/ansible-automation-platform-27/ee-supported-rhel9 +8
- RHSA-2026:87120 Released 2026-10-21 · Red Hat rating CriticalRed Hat Ansible Automation Platform 2.6 Container Release Update
- Red Hat Ansible Automation Platform 2.6 registry.redhat.io/ansible-automation-platform-26/eda-controller-rhel9, registry.redhat.io/ansible-automation-platform-26/ee-supported-rhel9, registry.redhat.io/ansible-automation-platform-26/gateway-rhel9 +8
- RHSA-2026:68695 Released 2026-09-17 · Red Hat rating ImportantKiali 2.27.4 for Red Hat OpenShift Service Mesh 3.4
- Red Hat OpenShift Service Mesh 3.4 registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9, registry.redhat.io/openshift-service-mesh/kiali-rhel9, registry.redhat.io/openshift-service-mesh/kiali-rhel9-operator
Vendor assessments
Red Hat
Red Hat rating: Important. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Migration Toolkit for Applications 8 | Affected | No fix yet |
| Migration Toolkit for Containers | Affected | No fix yet |
| Migration Toolkit for Virtualization | Affected | No fix yet |
| Red Hat Ansible Automation Platform 2 | Affected | No fix yet |
| Red Hat OpenShift Container Platform 4 | Affected | No fix yet |
| Red Hat OpenShift Container Platform 5 | Affected | No fix yet |
| Red Hat OpenStack Platform 16.2 | Affected | No fix yet |
| Red Hat OpenStack Platform 17.1 | Affected | No fix yet |
| Red Hat OpenStack Platform 18.0 | Affected | No fix yet |
| Service Telemetry Framework 1.5 | Affected | No fix yet |
| Red Hat Ansible Automation Platform 2.6 | Fixed | RHSA-2026:87120 |
| Red Hat Ansible Automation Platform 2.7 | Fixed | RHSA-2026:87124 |
| Red Hat OpenShift Service Mesh 3.4 | Fixed | RHSA-2026:68695 |
Not affected: 8 products
- Red Hat Advanced Cluster Management for Kubernetes 2
- Red Hat Ansible Automation Platform 2.6
- Red Hat Ansible Automation Platform 2.7
- Red Hat OpenShift Container Platform 4
- Red Hat OpenShift Container Platform 5
- Red Hat OpenShift Service Mesh 3.4
- Red Hat OpenShift Virtualization 4
- Service Telemetry Framework 1.5
Timeline
- 2026-10-16 Threatist record created from CVE-2026-92982
- 2026-10-16 CISA SSVC decision points changed
- 2026-10-16 Affected versions changed · Red Hat
- 2026-10-16 CVSS score added · Red Hat
- 2026-10-21 Fix available: ansible-automation-platform-26/lightspeed-rhel9-operator@1791840864, ansible-automation-platform-27/lightspeed-rhel9-operator@1792138238 · CNA
- 2026-10-21 2 new references · CNA
- 2026-10-21 Alias added: GHSA-38c7-8hx4-q72m
- 2026-10-22 Fix available: RHSA-2026:87124 · Red Hat
- 2026-10-22 Fix available: RHSA-2026:87120 · Red Hat
- 2026-10-22 Fix available: Red Hat Ansible Automation Platform 2.6, Red Hat Ansible Automation Platform 2.7 · Red Hat
- 2026-10-29 Fix available: openshift-service-mesh/kiali-rhel9-operator@1789021200 · CNA
- 2026-10-29 1 new reference · CNA
- 2026-10-29 Fix available: RHSA-2026:68695 · Red Hat
- 2026-10-29 Fix available: Red Hat OpenShift Service Mesh 3.4 · Red Hat
- 2026-10-30 Affected versions changed · CNA
- 2026-10-30 Affected versions changed · Red Hat
References
More Red Hat vulnerabilities
- TI-2019-15875 Protection mechanism failure in Jenkins Pipeline: Groovy Plugin KEVCVSS 3.1CRITICAL 9.9
- TI-2019-15874 Protection mechanism failure in Jenkins Script Security Plugin KEVCVSS 3.1CRITICAL 9.9
- TI-2019-08259 Underflow in PHP-FPM can lead to RCE KEVCVSS 3.1CRITICAL 9.8
- TI-2019-05363 Code injection in Elastic Kibana KEVCVSS 3.1CRITICAL 10.0
- TI-2019-03949 Out-of-bounds write in ESXi and Horizon DaaS KEVCVSS 3.1CRITICAL 9.8
- TI-2018-16080 A code execution vulnerability exists in the Stapler web framework used by Jenkins 2.153… KEVCVSS 3.1CRITICAL 9.8
Sources
- CVE-2026-92982 · CVE Program
- CVE-2026-92982 · NVD
- FIRST EPSS
- GHSA-38c7-8hx4-q72m · GitHub Advisory Database · CC BY 4.0
- CVE-2026-92982 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences