openshift-ansible CVE-2026-92092

Exploitation requires an OpenShift install that uses the openshift-ansible installer container whose run script downloads remote inventory and dynamic (inventory) scripts over a channel with no integrity verification, such as plain HTTP. The attacker must either hold a Man-in-the-Middle position on the network path between the installer and the script host, or have already compromised the HTTP server serving those scripts - this unattacker-controlled precondition is what drives CVSS AC:H. No authentication to the installer and no user interaction are needed (PR:N/UI:N), but exploitation is limited to the window during which the installer actually runs and only to deployments configured to fetch these scripts remotely rather than from verified or local sources; installs that do not retrieve the scripts over an unprotected channel are not exposed.

The CVSS 3.1 base score is 7.4 (High) with vector AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N. The network vector (AV:N) and lack of required privileges or user interaction (PR:N/UI:N) raise the apparent reach, but the High attack complexity (AC:H) is the dominant limiter: exploitation depends on the attacker first achieving a Man-in-the-Middle position on the installer-to-server path or compromising the HTTP server that supplies the inventory and dynamic scripts, neither of which is attacker-controlled by default. No EPSS score, no CISA KEV entry, and no public PoC are present in the supplied data, so there is no signal of active or probable near-term exploitation; this is consistent with the vuln.today 'this_week' priority rather than an emergency. The impact if the preconditions are met is serious - arbitrary code execution with the installer's UID and full cluster-provisioning privileges (C:H/I:H) - so the realistic risk is a high-impact-but-precondition-gated issue affecting a specific install flow, not a broadly exploitable internet-facing flaw. Note the input lists A:N despite describing full arbitrary code execution; an attacker with that control could plausibly also affect availability, so the A:N rating may understate impact - verify with the vendor advisory.

An organization runs the openshift-ansible installer container, whose run script retrieves remote inventory and dynamic scripts over an unverified channel. An attacker positioned to intercept that traffic (MITM) or who has compromised the hosting HTTP server replaces a legitimate script with a malicious executable; the installer downloads and runs it without any integrity check, executing attacker code with the installer's UID and full cluster-provisioning privileges. No public exploit is identified at time of analysis.