Live › vulnerability › CVE-2026-92092
The openshift-ansible installer container's run script downloads inventory and dynamic scripts over HTTP without integrity checks. An attacker who can intercept that traffic or control the HTTP server can substitute an executable that runs with the installer's privileges and cluster-provisioning rights.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-29 20:26 UTC. All times on this page are UTC.
Teams that run the openshift-ansible installer container with INVENTORY_URL or DYNAMIC_SCRIPT_URL pointing to a remote server, especially over plain HTTP or an untrusted network. An attacker who can intercept the traffic or compromise that server can substitute a script that runs with the installer's privileges. Teams that supply local inventory files or run in isolated networks can skip it, per Red Hat.
No product ranges from the sources yet.
No fix yet, per the sources.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
A flaw was found in openshift-ansible. The installer container's run script downloads and executes remote inventory and dynamic scripts without integrity verification. A remote attacker, by performing a Man-in-the-Middle (MITM) attack or compromising the HTTP server providing these scripts, could substitute an arbitrary executable. This malicious executable would then run with the installer's user ID (UID) and full cluster-provisioning privileges, leading to arbitrary code execution.
This page as .md · .json · in your agent: get_signal("CVE-2026-92092")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.