CVE-2026-92092：A flaw was found in openshift-ansible. The installer container's `run`

A flaw was found in openshift-ansible. The installer container's run script downloads and executes remote inventory and dynamic scripts without integrity verification. A remote attacker, by performing a Man-in-the-Middle (MITM) attack or compromising the HTTP server providing these scripts, could substitute an arbitrary executable. This malicious executable would then run with the installer's user ID (UID) and full cluster-provisioning privileges, leading to arbitrary code execution.

漏洞详情

A flaw was found in openshift-ansible. The installer container's run script downloads and executes remote inventory and dynamic scripts without integrity verification. A remote attacker, by performing a Man-in-the-Middle (MITM) attack or compromising the HTTP server providing these scripts, could substitute an arbitrary executable. This malicious executable would then run with the installer's user ID (UID) and full cluster-provisioning privileges, leading to arbitrary code execution.

风险评估

• CVSS 评分：7.4（HIGH）
• 评分版本：CVSS 3.1
• 攻击向量：CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N

弱点类型

CWE-494

参考链接

• https://access.redhat.com/security/cve/CVE-2026-92092
• https://bugzilla.redhat.com/show_bug.cgi?id=2515862

数据来源：NVD（美国国家漏洞数据库），入库时按 CVSS 评分筛选。

原文链接： CVE-2026-92092：A flaw was found in openshift-ansible. The installer container's run