Description
A flaw was found in Ansible Operator Plugins. A low-privileged Kubernetes user can exploit a Jinja2 template injection vulnerability by crafting malicious custom resource (CR) specification values. These values are processed by Ansible without proper sanitization, allowing embedded Jinja2 expressions to be executed within the operator pod. This can lead to arbitrary code execution and privilege escalation, granting the attacker control over the operator's service account with cluster-wide permissions.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
Red Hat Red Hat Ansible Automation Platform 2.6
Default version status: affected
1791840864 to < *unaffected
Red Hat Red Hat Ansible Automation Platform 2.7
Default version status: affected
1792138238 to < *unaffected
Red Hat Red Hat OpenShift Service Mesh 3.4
Default version status: affected
1789021200 to < *unaffected
Red Hat Migration Toolkit for Applications 8
Default version status: affected
Red Hat Migration Toolkit for Containers
Default version status: affected
Red Hat Migration Toolkit for Virtualization
Default version status: affected
Red Hat Red Hat Advanced Cluster Management for Kubernetes 2
Default version status: unaffected
Red Hat Red Hat Advanced Cluster Management for Kubernetes 2
Default version status: unaffected
Red Hat Red Hat Ansible Automation Platform 2
Default version status: affected
Red Hat Red Hat Ansible Automation Platform 2
Default version status: affected
Red Hat Red Hat Ansible Automation Platform 2
Default version status: affected
Red Hat Red Hat Ansible Automation Platform 2
Default version status: affected
Red Hat Red Hat Ansible Automation Platform 2
Default version status: affected
Red Hat Red Hat Ansible Automation Platform 2
Default version status: affected
Red Hat Red Hat Ansible Automation Platform 2
Default version status: affected
Red Hat Red Hat Ansible Automation Platform 2
Default version status: affected
Red Hat Red Hat Ansible Automation Platform 2
Default version status: affected
Red Hat Red Hat Ansible Automation Platform 2
Default version status: affected
Red Hat Red Hat Ansible Automation Platform 2
Default version status: affected
Red Hat Red Hat Ansible Automation Platform 2
Default version status: affected
Red Hat Red Hat Ansible Automation Platform 2
Default version status: affected
Red Hat Red Hat Ansible Automation Platform 2
Default version status: affected
Red Hat Red Hat OpenShift Container Platform 4
Default version status: affected
Red Hat Red Hat OpenShift Container Platform 4
Default version status: unaffected
Red Hat Red Hat OpenShift Container Platform 4
Default version status: affected
Red Hat Red Hat OpenShift Container Platform 5
Default version status: affected
Red Hat Red Hat OpenShift Container Platform 5
Default version status: unaffected
Red Hat Red Hat OpenShift Virtualization 4
Default version status: unaffected
Red Hat Red Hat OpenStack Platform 16.2
Default version status: affected
Red Hat Red Hat OpenStack Platform 17.1
Default version status: affected
Red Hat Red Hat OpenStack Platform 18.0
Default version status: affected
Red Hat Service Telemetry Framework 1.5
Default version status: unaffected
Red Hat Service Telemetry Framework 1.5
Default version status: affected