CVE-2026-92982: Improper Neutralization of Special Elements Used in a Template Engine in Red Hat Migration Toolkit for Applications 8

This vulnerability arises from improper neutralization of special elements used in the Jinja2 template engine within Ansible Operator Plugins in Red Hat Migration Toolkit for Applications 8. Specifically, maliciously crafted custom resource (CR) specification values containing embedded Jinja2 expressions are processed without adequate sanitization, enabling execution of arbitrary code inside the operator pod. Exploitation requires low privileges but can result in privilege escalation to the operator's service account with cluster-wide access.

Successful exploitation allows an attacker with low Kubernetes privileges to execute arbitrary code within the operator pod and escalate privileges to the operator's service account, which has cluster-wide permissions. This can lead to full control over the Kubernetes cluster resources accessible by that service account, posing a critical risk to confidentiality, integrity, and availability.

Patch status is not yet confirmed — check the Red Hat advisory at https://access.redhat.com/security/cve/CVE-2026-92982 for current remediation guidance. Until a patch is applied, restrict access to Kubernetes custom resource specifications and limit permissions of users who can create or modify these resources to mitigate exploitation risk.