Към съдържанието
Търсене

CVE-2026-92982: Red Hat Ansible Automation Platform 2.6, инжекция

8.5

CVSS 3.1

Няма данни

Вероятност да бъде експлоатирана в следващите 30 дни (EPSS)

Няма потвърждение

Атакува се

Няма данни

Време до експлоатация

Атакува се по мрежата, при специфични условия, с обикновен потребителски вход и без действие от потребителя.

CVE радар: още уязвимости от този вид

  • Експлоатация: няма данни за експлоатация
  • Атаката не може да се автоматизира

Описание

Оригинално описание

A flaw was found in Ansible Operator Plugins. A low-privileged Kubernetes user can exploit a Jinja2 template injection vulnerability by crafting malicious custom resource (CR) specification values. These values are processed by Ansible without proper sanitization, allowing embedded Jinja2 expressions to be executed within the operator pod. This can lead to arbitrary code execution and privilege escalation, granting the attacker control over the operator's service account with cluster-wide permissions.

Засегнати продукти

  • Red Hat Red Hat Ansible Automation Platform 2.6: 1791840864 преди *
  • Red Hat Red Hat Ansible Automation Platform 2.7: 1792138238 преди *
  • Red Hat Red Hat OpenShift Service Mesh 3.4: 1789021200 преди *
  • Red Hat Migration Toolkit for Applications 8
  • Red Hat Migration Toolkit for Containers
  • Red Hat Migration Toolkit for Virtualization
  • Red Hat Red Hat Advanced Cluster Management for Kubernetes 2
  • Red Hat Red Hat Advanced Cluster Management for Kubernetes 2
  • Red Hat Red Hat Ansible Automation Platform 2
  • Red Hat Red Hat Ansible Automation Platform 2
  • Red Hat Red Hat Ansible Automation Platform 2
  • Red Hat Red Hat Ansible Automation Platform 2
  • Red Hat Red Hat Ansible Automation Platform 2
  • Red Hat Red Hat Ansible Automation Platform 2
  • Red Hat Red Hat Ansible Automation Platform 2
  • Red Hat Red Hat Ansible Automation Platform 2
  • Red Hat Red Hat Ansible Automation Platform 2
  • Red Hat Red Hat Ansible Automation Platform 2
  • Red Hat Red Hat Ansible Automation Platform 2
  • Red Hat Red Hat Ansible Automation Platform 2
  • Red Hat Red Hat Ansible Automation Platform 2
  • Red Hat Red Hat Ansible Automation Platform 2
  • Red Hat Red Hat OpenShift Container Platform 4
  • Red Hat Red Hat OpenShift Container Platform 4
  • Red Hat Red Hat OpenShift Container Platform 4
  • Red Hat Red Hat OpenShift Container Platform 5
  • Red Hat Red Hat OpenShift Container Platform 5
  • Red Hat Red Hat OpenShift Virtualization 4
  • Red Hat Red Hat OpenStack Platform 16.2
  • Red Hat Red Hat OpenStack Platform 17.1
  • Red Hat Red Hat OpenStack Platform 18.0
  • Red Hat Service Telemetry Framework 1.5
  • Red Hat Service Telemetry Framework 1.5

Вид слабост

История

  • 15 октомври 2026 Публикувано

Други уязвимости в Red Hat Red Hat Ansible Automation Platform 2.6

Първоизточници

CVE-2026-92982: Red Hat Ansible Automation Platform 2.6, инжекция | freedomonline.bg