CVE-2026-92092

HighCVSS 7.4/10Last modified Nov 11, 2026

Description

A flaw was found in openshift-ansible. The installer container's `run` script downloads and executes remote inventory and dynamic scripts without integrity verification. A remote attacker, by performing a Man-in-the-Middle (MITM) attack or compromising the HTTP server providing these scripts, could substitute an arbitrary executable. This malicious executable would then run with the installer's user ID (UID) and full cluster-provisioning privileges, leading to arbitrary code execution.

Metrics

CVSS 3.1 7.4/10CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N

Weakness enumeration

CWE-494

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

Vendor	Product	Versions
Red Hat	Red Hat OpenShift Container Platform 4	—
Red Hat	Red Hat OpenShift Container Platform 5	—

References

Timeline

Published: Oct 29, 2026
Last modified: Nov 11, 2026
NVD status: Awaiting Analysis

Related CVEs from 2026

CVE-2026-920979.1The Click to Chat for WhatsApp plugin for WordPress is vulnerable to Arbitrary Shortcode Execution in versions up to, and including, 4.44 Th CVE-2026-920986.1The Webheadcoder Multi-Step Forms for Contact Form 7 plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'l10n_prin CVE-2026-920996.5The WPGraphQL Smart Cache WordPress plugin before 2.3.2 does not require authorisation or validate a caller-supplied query identifier before CVE-2026-92104.5Insufficient input validation vulnerability in the listed NETGEAR models allows authenticated administrators connected to the local network CVE-2026-921036.3Allocation of Resources Without Limits or Throttling vulnerability in elixir-mint mint allows a malicious HTTP/2 server to make the client h CVE-2026-921062.3Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in dashbitco lazy_html allows mutation XS CVE-2026-92118.8An unauthenticated user on the local network can gain control of the router and make unauthorized changes to its operation.CVE-2026-921145.3A vulnerability was identified in a2ui-project a2ui up to 0.10.6. Affected is an unknown function of the file renderers/web_core/src/v0_9/ba CVE-2026-921158.8The WP Photo Album Plus plugin for WordPress is vulnerable to authenticated Command Injection in all versions up to, and including, 9.3.02.0 CVE-2026-921169.1OAuth1 callback validation vulnerability in Apache Allura. This issue affects Apache Allura: through 1.21.0. Users are recommended to CVE-2026-921199.1REST API Mass Assignment vulnerability in Apache Allura. This issue affects Apache Allura: through 1.21.0. Users are recommended to up CVE-2026-92128.0Insufficient authentication and input validation in the listed NETGEAR models allow users connected to the local network to execute commands