Red Hat OpenShift Container Platform 4.14 · Vulnerability
Historical advisory recorded 11 Nov 2026 15:57:25 UTC. Read the latest advisory.
cve-program · CVE-2026-92092
PublishedA flaw was found in openshift-ansible. The installer container's `run` script downloads and executes remote inventory and dynamic scripts without integrity verification. A remote attacker, by performing a Man-in-the-Middle (MITM) attack or compromising the HTTP server providing these scripts, could substitute an arbitrary executable. This malicious executable would then run with the installer's user ID (UID) and full cluster-provisioning privileges, leading to arbitrary code execution.
Read the publisher's advisoryAffected versions, risk and source history
cve-program · CVE-2026-92092
PublishedOpenshift-ansible: openshift-ansible: installer container downloads and executes remote inventory script without integrity verification
A flaw was found in openshift-ansible. The installer container's `run` script downloads and executes remote inventory and dynamic scripts without integrity verification. A remote attacker, by performing a Man-in-the-Middle (MITM) attack or compromising the HTTP server providing these scripts, could substitute an arbitrary executable. This malicious executable would then run with the installer's user ID (UID) and full cluster-provisioning privileges, leading to arbitrary code execution.
- Source published
- 29 Oct 2026 19:51:44 UTC
- Source modified
- 11 Nov 2026 14:36:25 UTC
- Saved here
- 11 Nov 2026 15:57:25 UTC
- Source terms
- CVE Program Terms of Use
Original source record · Cite this exact observation · Complete original publisher JSON
Source: cve-program · CVE Program Terms of Use. The publisher's wording is preserved. ChangeIntel groups the information and labels changes. The JSON record includes additional source fields.
CVSS 3.1 · 7.4 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N