CVE-2024-56326 is a security vulnerability in the python-jinja2 package where a sandbox breakout occurs through an indirect reference to the format method. This allows bypassing Jinja2's sandbox restrictions. Red Hat has issued security advisories RHSA-2025:0667 and RHSA-2025:0711 providing updated python-jinja2 packages for Red Hat Enterprise Linux 8 and 9 to remediate this issue. The vulnerability is rated as Important by Red Hat Product Security. The advisory covers multiple architectures and extended update support versions. The fix is available in updated RPM packages and container images for Red Hat OpenShift Container Platform 4.12.73 and Red Hat Enterprise Linux 8 and 9 AppStream repositories.

The vulnerability allows a sandbox breakout in Jinja2 templates, potentially enabling an attacker to execute unauthorized code or commands within the context where Jinja2 templates are used. This could lead to privilege escalation or unauthorized access depending on the deployment context. Red Hat rates the security impact as Important (medium severity). There are no known exploits in the wild at this time.

Red Hat has released updated python-jinja2 packages that fix this vulnerability. Users of Red Hat Enterprise Linux 8 and 9, including Extended Update Support and Extended Life Cycle versions, should upgrade to the updated python-jinja2 packages as soon as they are available in their respective release channels. Instructions for upgrading OpenShift clusters and Red Hat Enterprise Linux systems are provided in the Red Hat advisories and documentation. No additional mitigations are required beyond applying the official updates.