Vulnerability details

CVE-2026-92092

Openshift-ansible: openshift-ansible: installer container downloads and executes remote inventory script without integrity verification

CVSS 3.1

7.4High

Official description

A flaw was found in openshift-ansible. The installer container's `run` script downloads and executes remote inventory and dynamic scripts without integrity verification. A remote attacker, by performing a Man-in-the-Middle (MITM) attack or compromising the HTTP server providing these scripts, could substitute an arbitrary executable. This malicious executable would then run with the installer's user ID (UID) and full cluster-provisioning privileges, leading to arbitrary code execution.

CVSS scores

Score	Version	Source	Vector
7.4High	3.1	CVEProject cvelistV5 (CNA) (redhat)	`CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N`

Affected products

Vendor	Product	Versions	Source
No product information recorded.

References and advisories

https://access.redhat.com/errata/RHSA-2026:95103 vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:95228 vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/security/cve/CVE-2026-92092 vdb-entryx_refsource_REDHAT
https://bugzilla.redhat.com/show_bug.cgi?id=2515862 issue-trackingx_refsource_REDHAT

Kolun on Telegram @kolunsec Exploited CVEs, key news and a daily digest Alerts for this product's next CVEsFollow the product to get new vulnerabilities on Telegram.

Details

Published: 2026-10-29
Last updated: 2026-11-09
State: Published
Assigner (CNA): redhat

Exploit prediction (EPSS)

0.24%

Probability of exploitation in 30 days

15.1%

Percentile (among all CVEs)

SSVC assessment (CISA)

Automatable: No
Exploitation: None
Technical impact: Total

Weaknesses (CWE)

CWE-494
Download of Code Without Integrity Check