CVE-2026-92982High· 8.5▾ TwilightA flaw was found in Ansible Operator Plugins. A low-privileged Kubernetes user can exploit a Jinja2 template injection vulnerability by crafting malicious custom resource (CR) specification values. These values are processed by Ansible w…
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 46.8 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
A flaw was found in Ansible Operator Plugins. A low-privileged Kubernetes user can exploit a Jinja2 template injection vulnerability by crafting malicious custom resource (CR) specification values. These values are processed by Ansible without proper sanitization, allowing embedded Jinja2 expressions to be executed within the operator pod. This can lead to arbitrary code execution and privilege escalation, granting the attacker control over the operator's service account with cluster-wide permissions.
Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2025-65106High· 8.2langchain-core: LangChain Vulnerable to Template Injection via Attribute Access in Prompt Templates (CVE-2025-65106)
CVE-2026-85634High· 8.8A flaw was found in the ContentRepositoryImpl.copyExplodedContent function of the wildfly-core library, which is used by WildFly and JBoss EAP to manage server deployments
CVE-2026-110924Medium· 4.8A flaw was found in OpenSSH
CVE-2026-110927Medium· 4.3A flaw was found in OpenSSH
CVE-2026-110925Medium· 5.4A flaw was found in OpenSSH
CVE-2026-110923Medium· 6.5A flaw was found in OpenSSH