CVE-2026-92982
High · 8.5CVSS
8.5
EPSS
0.5%
Published
Oct 15, 2026
CISA due date
—
The record
A flaw was found in Ansible Operator Plugins. A low-privileged Kubernetes user can exploit a Jinja2 template injection vulnerability by crafting malicious custom resource (CR) specification values. These values are processed by Ansible without proper sanitization, allowing embedded Jinja2 expressions to be executed within the operator pod. This can lead to arbitrary code execution and privilege escalation, granting the attacker control over the operator's service account with cluster-wide permissions.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|
Related vulnerabilities
- CVE-2026-107264 Improper Neutralization of Special Elements Used in a Template Engine vulnerability in… CWE-1336
- CVE-2026-107259 Improper Neutralization of Special Elements Used in a Template Engine vulnerability in… CWE-1336
- CVE-2026-61707 SOCFortress CoPilot focuses on providing a single pane of glass for all your security… CWE-1336
- CVE-2026-119144 Frappe Framework before 15.111.0 and 16.x before 16.21.0 contains a server-side template… CWE-1336
- CVE-2026-118803 Bricks Theme 2.4.3 and before contains an unauthenticated dynamic-data tag injection… CWE-1336
- CVE-2026-115223 The Smart Popup by Supsystic WordPress plugin before 2.0.2 does not prevent… CWE-1336
- CVE-2026-115938 Craft CMS allows any authenticated control panel user to submit an element-search… CWE-1336
- CVE-2026-55486 The Goobi viewer is a web application that allows digitised material to be displayed in a… CWE-1336