Every CVE Search/ Get API key

CVE-2026-84706

Automation-controller: automation-controller-container: automation-controller: credential type env-injector deny-list omits process-hijacking variables (bash_env/ld_preload) allowing code execution in the execution environment

7.6 High

A flaw was found in Ansible Automation Platform's automation-controller. The custom Credential Type environment-variable injector validates variable names against a deny-list (an ANSIBLE_* prefix check plus a fixed ENV_BLOCKLIST) that omits process-hijacking loader variables such as BASH_ENV, ENV, LD_PRELOAD, LD_LIBRARY_PATH, PYTHONSTARTUP and GIT_SSH_COMMAND. Combined with the credential file injector, a privileged user can write an attacker-controlled script into the execution environment and point BASH_ENV at it, obtaining arbitrary code execution inside the execution-environment container for any job that attaches a credential of that type.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
High
User interaction
None

What an attacker can affect

Confidentiality
Low
Integrity
High
Availability
None

Exploit likelihood

0.31%Unchanged since Sep 24, 2026
90%50%10%1%

What each source reports

CVE List Score used 7.6

Automation-controller: automation-controller-container: automation-controller: credential type env-injector deny-list omits process-hijacking variables (bash_env/ld_preload) allowing code execution in the execution environment

A flaw was found in Ansible Automation Platform's automation-controller. The custom Credential Type environment-variable injector validates variable names against a deny-list (an ANSIBLE_* prefix check plus a fixed ENV_BLOCKLIST) that omits process-hijacking loader variables such as BASH_ENV, ENV, LD_PRELOAD, LD_LIBRARY_PATH, PYTHONSTARTUP and GIT_SSH_COMMAND. Combined with the credential file injector, a privileged user can write an attacker-controlled script into the execution environment and point BASH_ENV at it, obtaining arbitrary code execution inside the execution-environment container for any job that attaches a credential of that type.

Record
CVE-2026-84706
CVSS 3.1
7.6 HighCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:H/A:N
Weakness
CWE-184
Updated
2026-11-02
EUVDEUVD-2026-85638 7.6

A flaw was found in Ansible Automation Platform's automation-controller. The custom Credential Type environment-variable injector validates variable names against a deny-list (an ANSIBLE_* prefix check plus a fixed ENV_BLOCKLIST) that omits process-hijacking loader variables such as BASH_ENV, ENV, LD_PRELOAD, LD_LIBRARY_PATH, PYTHONSTARTUP and GIT_SSH_COMMAND. Combined with the credential file injector, a privileged user can write an attacker-controlled script into the execution environment and point BASH_ENV at it, obtaining arbitrary code execution inside the execution-environment container for any job that attaches a credential of that type.

Record
EUVD-2026-85638
CVSS 3.1
7.6 HighCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:H/A:N
Updated
2026-11-02
GitHub AdvisoriesGHSA-5vrq-6q93-m3rf 7.6

A flaw was found in Ansible Automation Platform's automation-controller. The custom Credential...

A flaw was found in Ansible Automation Platform's automation-controller. The custom Credential Type environment-variable injector validates variable names against a deny-list (an ANSIBLE_* prefix check plus a fixed ENV_BLOCKLIST) that omits process-hijacking loader variables such as BASH_ENV, ENV, LD_PRELOAD, LD_LIBRARY_PATH, PYTHONSTARTUP and GIT_SSH_COMMAND. Combined with the credential file injector, a privileged user can write an attacker-controlled script into the execution environment and point BASH_ENV at it, obtaining arbitrary code execution inside the execution-environment container for any job that attaches a credential of that type.

Record
GHSA-5vrq-6q93-m3rf
CVSS 3.1
7.6 HighCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:H/A:N
Weakness
CWE-184
Updated
2026-11-02
NVD 7.6

A flaw was found in Ansible Automation Platform's automation-controller. The custom Credential Type environment-variable injector validates variable names against a deny-list (an ANSIBLE_* prefix check plus a fixed ENV_BLOCKLIST) that omits process-hijacking loader variables such as BASH_ENV, ENV, LD_PRELOAD, LD_LIBRARY_PATH, PYTHONSTARTUP and GIT_SSH_COMMAND. Combined with the credential file injector, a privileged user can write an attacker-controlled script into the execution environment and point BASH_ENV at it, obtaining arbitrary code execution inside the execution-environment container for any job that attaches a credential of that type.

Record
CVE-2026-84706
CVSS 3.1
7.6 HighCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:H/A:N
Weakness
CWE-184
Updated
2026-11-05
OSVRHSA-2026:71113 9.9

Red Hat Security Advisory: Red Hat Ansible Automation Platform 2.6 Product Security and Bug Fix Update

Record
RHSA-2026:71113
CVSS 3.1
9.9 CriticalCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Updated
2026-11-02
OSVRHSA-2026:71114 9.9

Red Hat Security Advisory: Red Hat Ansible Automation Platform 2.5 Product Security and Bug Fix Update

Record
RHSA-2026:71114
CVSS 3.1
9.9 CriticalCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
automation-controller-venv-tower
Red Hat:ansible_automation_platform:2.6::el9
From an advisory covering 61 CVEs
 before 0:4.7.17-1.el9ap
0:4.7.17-1.el9ap
receptor
Red Hat:ansible_automation_platform:2.6::el10
From an advisory covering 61 CVEs
 before 0:1.6.8-1.el10ap
0:1.6.8-1.el10ap
receptor
Red Hat:ansible_automation_platform_developer:2.6::el9
From an advisory covering 61 CVEs
 before 0:1.6.8-1.el9ap
0:1.6.8-1.el9ap
receptor
Red Hat:ansible_automation_platform_inside:2.6::el9
From an advisory covering 61 CVEs
 before 0:1.6.8-1.el9ap
0:1.6.8-1.el9ap
automation-gateway-proxy-server
Red Hat:ansible_automation_platform:2.6::el9
From an advisory covering 61 CVEs
 before 0:2.6.17-3.el9ap
0:2.6.17-3.el9ap
receptor
Red Hat:ansible_automation_platform:2.6::el9
From an advisory covering 61 CVEs
 before 0:1.6.8-1.el9ap
0:1.6.8-1.el9ap
python-sqlparse
Red Hat:ansible_automation_platform_developer:2.6::el10
From an advisory covering 61 CVEs
 before 0:0.6.0-1.el10ap
0:0.6.0-1.el10ap
python3-sqlparse
Red Hat:ansible_automation_platform_developer:2.6::el10
From an advisory covering 61 CVEs
 before 0:0.6.0-1.el10ap
0:0.6.0-1.el10ap
python-sqlparse
Red Hat:ansible_automation_platform:2.6::el10
From an advisory covering 61 CVEs
 before 0:0.6.0-1.el10ap
0:0.6.0-1.el10ap
python3-sqlparse
Red Hat:ansible_automation_platform:2.6::el10
From an advisory covering 61 CVEs
 before 0:0.6.0-1.el10ap
0:0.6.0-1.el10ap
Show 28 moreShow less
Affected packages
PackageAffectedFixed
python3.12-sqlparse
Red Hat:ansible_automation_platform_developer:2.6::el9
From an advisory covering 61 CVEs
 before 0:0.6.0-1.el9ap
0:0.6.0-1.el9ap
python3.12-sqlparse
Red Hat:ansible_automation_platform:2.6::el9
From an advisory covering 61 CVEs
 before 0:0.6.0-1.el9ap
0:0.6.0-1.el9ap
automation-platform-ui
Red Hat:ansible_automation_platform:2.6::el9
From an advisory covering 61 CVEs
 before 0:2.6.14-1.el9ap
0:2.6.14-1.el9ap
automation-controller
Red Hat:ansible_automation_platform_developer:2.6::el9
From an advisory covering 61 CVEs
 before 0:4.7.17-1.el9ap
0:4.7.17-1.el9ap
automation-controller-cli
Red Hat:ansible_automation_platform_developer:2.6::el9
From an advisory covering 61 CVEs
 before 0:4.7.17-1.el9ap
0:4.7.17-1.el9ap
automation-controller
Red Hat:ansible_automation_platform:2.6::el9
From an advisory covering 61 CVEs
 before 0:4.7.17-1.el9ap
0:4.7.17-1.el9ap
automation-controller-cli
Red Hat:ansible_automation_platform:2.6::el9
From an advisory covering 61 CVEs
 before 0:4.7.17-1.el9ap
0:4.7.17-1.el9ap
automation-controller-server
Red Hat:ansible_automation_platform:2.6::el9
From an advisory covering 61 CVEs
 before 0:4.7.17-1.el9ap
0:4.7.17-1.el9ap
automation-controller-ui
Red Hat:ansible_automation_platform:2.6::el9
From an advisory covering 61 CVEs
 before 0:4.7.17-1.el9ap
0:4.7.17-1.el9ap
python3.12-gitpython
Red Hat:ansible_automation_platform:2.6::el9
From an advisory covering 61 CVEs
 before 0:3.1.60-1.el9ap
0:3.1.60-1.el9ap
automation-controller-venv-tower
Red Hat:ansible_automation_platform:2.5::el8
From an advisory covering 57 CVEs
 before 0:4.6.33-1.el8ap
0:4.6.33-1.el8ap
automation-controller-venv-tower
Red Hat:ansible_automation_platform:2.5::el9
From an advisory covering 57 CVEs
 before 0:4.6.33-1.el9ap
0:4.6.33-1.el9ap
receptor
Red Hat:ansible_automation_platform_developer:2.5::el8
From an advisory covering 57 CVEs
 before 0:1.6.8-1.el8ap
0:1.6.8-1.el8ap
receptor
Red Hat:ansible_automation_platform_inside:2.5::el8
From an advisory covering 57 CVEs
 before 0:1.6.8-1.el8ap
0:1.6.8-1.el8ap
automation-gateway-proxy-server
Red Hat:ansible_automation_platform:2.5::el8
From an advisory covering 57 CVEs
 before 0:2.5.10-8.el8ap
0:2.5.10-8.el8ap
receptor
Red Hat:ansible_automation_platform:2.5::el8
From an advisory covering 57 CVEs
 before 0:1.6.8-1.el8ap
0:1.6.8-1.el8ap
receptor
Red Hat:ansible_automation_platform_developer:2.5::el9
From an advisory covering 57 CVEs
 before 0:1.6.8-1.el9ap
0:1.6.8-1.el9ap
receptor
Red Hat:ansible_automation_platform_inside:2.5::el9
From an advisory covering 57 CVEs
 before 0:1.6.8-1.el9ap
0:1.6.8-1.el9ap
automation-gateway-proxy-server
Red Hat:ansible_automation_platform:2.5::el9
From an advisory covering 57 CVEs
 before 0:2.6.17-3.el9ap
0:2.6.17-3.el9ap
receptor
Red Hat:ansible_automation_platform:2.5::el9
From an advisory covering 57 CVEs
 before 0:1.6.8-1.el9ap
0:1.6.8-1.el9ap
python3.12-sqlparse
Red Hat:ansible_automation_platform_developer:2.5::el8
From an advisory covering 57 CVEs
 before 0:0.6.0-1.el8ap
0:0.6.0-1.el8ap
python3.12-sqlparse
Red Hat:ansible_automation_platform:2.5::el8
From an advisory covering 57 CVEs
 before 0:0.6.0-1.el8ap
0:0.6.0-1.el8ap
python3.12-sqlparse
Red Hat:ansible_automation_platform_developer:2.5::el9
From an advisory covering 57 CVEs
 before 0:0.6.0-1.el9ap
0:0.6.0-1.el9ap
python3.12-sqlparse
Red Hat:ansible_automation_platform:2.5::el9
From an advisory covering 57 CVEs
 before 0:0.6.0-1.el9ap
0:0.6.0-1.el9ap
automation-gateway-server
Red Hat:ansible_automation_platform:2.5::el8
From an advisory covering 57 CVEs
 before 0:2.5.20260923-1.el8ap
0:2.5.20260923-1.el8ap
automation-gateway-server
Red Hat:ansible_automation_platform:2.5::el9
From an advisory covering 57 CVEs
 before 0:2.5.20260923-1.el9ap
0:2.5.20260923-1.el9ap
python3.12-gitpython
Red Hat:ansible_automation_platform:2.5::el8
From an advisory covering 57 CVEs
 before 0:3.1.60-1.el8ap
0:3.1.60-1.el8ap
python3.12-gitpython
Red Hat:ansible_automation_platform:2.5::el9
From an advisory covering 57 CVEs
 before 0:3.1.60-1.el9ap
0:3.1.60-1.el9ap

History

History
RecordedChangedSources
affected, facts
factsNVD
first indexedCVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2026-84706 is a high vulnerability (CVSS 7.6) in Red Hat Ansible Automation Platform 2.5 For Rhel 8, published September 23, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.31%, the 23rd percentile. No source names a fixed version.

References

Show 194 moreShow less
This page doesn't list everything

Left out here: 136 references. The JSON record has them.

Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open