Ansible Operator Plugins: Jinja2 template injection in CR spec values gives cluster-wide code execution

Impact

An operator built on the Ansible Operator Plugins passes custom resource spec values into Ansible without sanitizing them, so Jinja2 expressions embedded in a CR are evaluated inside the operator pod. A low-privileged Kubernetes user who can create or edit one of those custom resources gets arbitrary code execution in the operator pod and, with it, the operator's service account - typically cluster-wide permissions. On a shared GPU cluster that is a straight path from a tenant namespace to cluster admin, which means access to every other tenant's workloads, secrets and node configuration. Red Hat lists the affected shipping products as OpenShift Container Platform 4, Advanced Cluster Management 2, OpenShift Service Mesh 3, Ansible Automation Platform 2 and the migration toolkits, all of which can carry Ansible-based operators.

Who can reach it

Authenticated Kubernetes user with permission to create or update a custom resource handled by an Ansible-based operator. No cluster-admin needed; no direct network access to the operator required.

What to do

Track the fixed operator builds in the Red Hat advisory for CVE-2026-92982 and update the affected operators; for self-built operators, rebuild against a patched Ansible Operator Plugins release. Remediation is an operator image bump and pod restart, not a node action. In the meantime, restrict RBAC on the custom resources these operators watch so only trusted service accounts can write them, and review the operator service accounts for permissions wider than they need.

References

Related entries

• Arcane: repointing a registry URL leaks the stored registry credential to an attacker-controlled hostCVE-2026-96626 · Arcane container management (container_registry_service.go registry URL update)High
• Docker / moby: Command execution via crafted remote git build path in `docker build`CVE-2019-13139 · Docker / mobyHigh
• Rancher: Sensitive data leaked into Rancher audit logsCVE-2023-22649 · RancherHigh
• runc: Insufficient checks when bind-mounting /dev/console allow writes to arbitrary host procfs pathsCVE-2025-52565 · runcHigh
• BuildKit: Custom frontend can craft an API message causing daemon compromiseCVE-2026-33747 · BuildKitHigh
• Helm: Crafted plugin writes its contents to an arbitrary filesystem location on install or updateCVE-2026-35204 · HelmHigh