---
id: "CVE-2026-92092"
kind: "vulnerability"
aliases: ["CVE-2026-92092"]
title: "openshift-ansible: installer downloads unverified scripts, enabling code execution with cluster privileges"
severity: "high"
cvss: 7.4
epss: null
exploited: false
status: "open"
category: "infrastructure"
products: []
ecosystems: []
tags: ["ansible", "infrastructure", "installer", "kubernetes", "openshift", "openshift-ansible", "self-hosted"]
not_affected_if: ["https-verified-inventory", "isolated-network", "local-inventory-only"]
published_at: "2026-10-29T20:17:36+00:00"
first_seen_at: "2026-10-29T20:26:51+00:00"
updated_at: "2026-10-29T20:29:14+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-92092", "first_seen_at": "2026-10-29T20:26:51+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-10-29T20:29:14+00:00"}]
---

# openshift-ansible: installer downloads unverified scripts, enabling code execution with cluster privileges

The openshift-ansible installer container's run script downloads inventory and dynamic scripts over HTTP without integrity checks. An attacker who can intercept that traffic or control the HTTP server can substitute an executable that runs with the installer's privileges and cluster-provisioning rights.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

Check whether the installer container is run with INVENTORY_URL or DYNAMIC_SCRIPT_URL set (env, wrapper scripts, CI config). If neither is set and you supply local inventory files, the remote fetch is not triggered. Affected version ranges: not published by Red Hat.

## Timeline

- 2026-10-29T20:26:51+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-92092
- 2026-10-29T20:29:14+00:00 analyst — Read Red Hat CVE page (primary). Exposure only when INVENTORY_URL or DYNAMIC_SCRIPT_URL is set; no fixed version or affected range published, so fix left unknown.

## Documents

- [advisory] Red Hat CVE-2026-92092 https://access.redhat.com/security/cve/CVE-2026-92092

## From the sources

A flaw was found in openshift-ansible. The installer container's `run` script downloads and executes remote inventory and dynamic scripts without integrity verification. A remote attacker, by performing a Man-in-the-Middle (MITM) attack or compromising the HTTP server providing these scripts, could substitute an arbitrary executable. This malicious executable would then run with the installer's user ID (UID) and full cluster-provisioning privileges, leading to arbitrary code execution.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_