Vulnerability in Red Hat Migration Toolkit For Applications 8
CVE-2026-92982
A flaw was found in Ansible Operator Plugins. A low-privileged Kubernetes user can exploit a Jinja2 template injection vulnerability by crafting malicious custom resource (CR) specification values. These values are processed by Ansible without proper sanitization, allowing embedded Jinja2 expressions to be executed within the operator pod. This can lead to arbitrary code execution and privilege escalation, granting the attacker control over the operator's service account with cluster-wide permissions.
Published · last modified .
CVSS v3 metric
CVSS v3 base score 8.5 (High). Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H.
EPSS exploit prediction
No EPSS score from FIRST.org yet. New CVEs usually get one within a few days; no score means no signal yet, not low risk. How EPSS works.
Affected products
- Red Hat Migration Toolkit For Applications 8
- Red Hat Migration Toolkit For Containers
- Red Hat Migration Toolkit For Virtualization
- Red Hat Openshift Service Mesh 3
- Red Hat Ansible Automation Platform 2
- Red Hat Openshift Container Platform 4
- Red Hat OpenStack Platform 16.2
- Red Hat OpenStack Platform 17.1
- Red Hat OpenStack Platform 18.0
- Red Hat Service Telemetry Framework 1.5
Weakness classification (CWE)
References
- access.redhat.com/security/cve/CVE-2026-92982 (vdb-entry)
- bugzilla.redhat.com/show_bug.cgi (issue-tracking)
Frequently asked questions
- What is CVE-2026-92982?
- CVE-2026-92982 is a high-severity vulnerability in Red Hat Migration Toolkit For Applications 8, classified under Improper Neutralization of Special Elements Used in a Template Engine. CVSS score: 8.5/10. Published 2026-10-15.
- How severe is CVE-2026-92982?
- High severity. CVSS v3 base score is 8.5 out of 10.