Bug 2522227 (CVE-2026-92982)

Summary: CVE-2026-92982 ansible-operator-plugins: Ansible Operator Plugins: Arbitrary Code Execution via Jinja2 Template Injection
Product: [Other] Security Response Reporter: OSIDB Bzimport <bzimport>
Component: vulnerabilityAssignee: Product Security <prodsec-ir-bot>
Status: NEW --- QA Contact:
Severity: high Docs Contact:
Priority: high    
Version: unspecifiedCC: akhatavk, aos-team-art-private, asdas, dkeler, dpaolell, dschmidt, dymurray, eglynn, gparvin, ibolton, ikhan, jbalunas, jdelft, jjoyce, jlanda, jmatthew, jmontleo, jpretori, jsamir, jschluet, jupierce, kbempah, kshier, lgarciaa, lhh, mbiarnes, mburns, mgarciac, mrunge, pakotvan, pgaikwad, ppalepu, ppostler, prdhamdh, rbobbitt, rhaigner, rjohnson, security-response-team, sghai, sidsharm, simaishi, slucidi, solenoci, sseago, stcannon, sthirugn, suppawar, teagle, thason, tsze, vimartin, vlaad, yguenane
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: ---
Doc Text:
A flaw was found in Ansible Operator Plugins. A low-privileged Kubernetes user can exploit a Jinja2 template injection vulnerability by crafting malicious custom resource (CR) specification values. These values are processed by Ansible without proper sanitization, allowing embedded Jinja2 expressions to be executed within the operator pod. This can lead to arbitrary code execution and privilege escalation, granting the attacker control over the operator's service account with cluster-wide permissions.
 Story Points: ---
Clone Of: Environment:
Last Closed: Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:

Description OSIDB Bzimport 2026-08-24 17:39:32 UTC 
## CR spec values passed to Ansible without unsafe-marking by default (Jinja2 template injection)

**CWEs:** CWE-1336, CWE-94
**CVSS:** 8.5 (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H)
**Component:** kiali-ossm/ansible-operator-plugins

### Description
makeParameters() copies every field of a watched custom resource's spec verbatim into the ansible-runner extravars, and only wraps string values with __ansible_unsafe when the watch sets markUnsafe: true. The default is false (watches.go:81) and the scaffolded watches.yaml does not enable it. Ansible renders extra vars through Jinja2 wherever a playbook or role templates them, so a Kubernetes user who can create or update the watched CR (a namespaced, typically low-privilege grant) can place Jinja2 expressions in spec fields that are evaluated inside the operator pod during reconciliation.

### Affected Locations
- `:`
- `:`

### Evidence
**internal/ansible/runner/runner.go:356-360 — unsafe-marking is opt-in**
```go
if r.markUnsafe {
    for key, val := range parameters {
        parameters[key] = markUnsafe(val)
    }
}
```

**internal/ansible/watches/watches.go:81 — default leaves CR values templatable**
```go
markUnsafeDefault                  = false
```

### Attack Pattern
A user with create/update on the watched CR gains code execution in the operator pod and thereby the operator service account's cluster RBAC.

---
*Source: Ex-Wing security assessment, finding FIND-001*