Jinja2 Template Injection Vulnerability in Ansible Operator Plugins

CVE-2026-92982

What is CVE-2026-92982?

A vulnerability exists in Ansible Operator Plugins that enables a low-privileged Kubernetes user to exploit a Jinja2 template injection flaw. By crafting malicious custom resource specification values, these inputs are processed by Ansible without adequate sanitization. Consequently, this flaw allows the execution of embedded Jinja2 expressions within the operator pod, potentially leading to arbitrary code execution. The outcome of such exploitation can lead to privilege escalation, enabling attackers to gain control over the operator's service account with cluster-wide permissions. This vulnerability poses significant risks to Kubernetes environments leveraging Ansible Operator Plugins.

References