CVE-2026-92092
Openshift-ansible: openshift-ansible: installer container downloads and executes remote inventory script without integrity verification
- State
- Published
- Severity
- 7.4 High
- Published
- Oct 29, 2026
- Updated
- Oct 30, 2026
- Reserved
- Sep 15, 2026
Description
A flaw was found in openshift-ansible. The installer container's `run` script downloads and executes remote inventory and dynamic scripts without integrity verification. A remote attacker, by performing a Man-in-the-Middle (MITM) attack or compromising the HTTP server providing these scripts, could substitute an arbitrary executable. This malicious executable would then run with the installer's user ID (UID) and full cluster-provisioning privileges, leading to arbitrary code execution.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 3.1 | 7.4 High | CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N | redhat |
Weaknesses
- CWE-494 Download of Code Without Integrity Check
Affected Products
| Product | Versions |
|---|---|
Red Hat OpenShift Container Platform 4Red Hat | |
Red Hat OpenShift Container Platform 5Red Hat |
References
- https://access.redhat.com/security/cve/CVE-2026-92092vdb-entry
- RHBZ#2515862issue-tracking
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.