High priorityDisclosed

Advisory · CVE-2026-92982

Jinja2 template injection in Ansible operator plugins can hand a low-privilege Kubernetes user the operator's cluster-wide account

A Jinja2 template injection flaw in Ansible Operator Plugins lets a low-privileged Kubernetes user run code inside the operator pod through crafted custom resource values, taking over its service account. Red Hat rates it CVSS 3.1 8.5.

Advisory published October 15, 2026Independent summary
Vendor
Red Hat
Product
Ansible Operator Plugins
Identifier / CWE
CVE-2026-92982
CWE-1336
Action timing
Immediate
ELI5

Explain it like I’m five

The operator reads values from a custom resource and pastes them into a Jinja2 template without cleaning them, so a user who can create that resource can smuggle in template commands that run with the operator's powerful cluster account.

SIMPLIFIED_ATTACK_PATH04 STEPS
  1. 01Low-privilege user creates a resource

    A Kubernetes user with limited rights submits a custom resource whose spec values contain Jinja2 expressions.

  2. 02Operator renders the values

    An Ansible-based operator processes the spec through Jinja2 templating without proper sanitization.

  3. 03Template code executes

    The embedded expressions run inside the operator pod.

  4. 04Operator account taken over

    Execution inherits the operator's service account, which Red Hat describes as carrying cluster-wide permissions.

What happened

Red Hat disclosed CVE-2026-92982 on October 15, 2026: a Jinja2 template injection vulnerability (CWE-1336) in Ansible Operator Plugins. Custom resource spec values are processed by Ansible without proper sanitization, so embedded Jinja2 expressions execute within the operator pod and can escalate to control of the operator’s service account. Red Hat rates it CVSS 3.1 8.5, with scope changed.

Red Hat’s record lists the vulnerable operator code across a wide set of its products, including Ansible Automation Platform, OpenShift Container Platform operators, Migration Toolkit products, OpenShift Service Mesh (Kiali operator), and OpenStack operators. Match your installed operators to Red Hat’s errata rather than assuming a single product line.

What to do

  1. Inventory Ansible-based operators in every cluster, including operators shipped inside Red Hat product bundles.
  2. Apply the Red Hat errata for each affected operator as they are published, and redeploy the operator pods.
  3. Until patched, restrict who can create or update the custom resources those operators reconcile, using Kubernetes RBAC.
  4. Review operator pod logs and audit logs for custom resources containing template syntax in spec values.
  5. Check whether operator service accounts hold cluster-wide permissions and trim them where the operator allows it.
  6. Verify the running operator image or package version after remediation.

Management note

Operators are force multipliers: one templating flaw converts ordinary namespace-level access into the operator’s cluster-wide identity. Treat operator patching and operator RBAC as cluster-admin hygiene, not application maintenance.