{"id":"CVE-2026-85475","aliases":["EUVD-2026-85607","GHSA-wpwh-486h-5v3j"],"status":"published","title":"Automation-controller: automation-controller-container: automation-controller: rsyslog configuration injection via log_aggregator_* settings leads to remote code execution in the control-plane rsyslog component","description":"A flaw was found in the Ansible Automation Platform automation controller. The\nexternal logging (rsyslog) configuration is generated by interpolating\nuser-controlled settings — LOG_AGGREGATOR_HOST, LOG_AGGREGATOR_MAX_DISK_USAGE_PATH\nand LOG_AGGREGATOR_RSYSLOGD_ERROR_LOG_FILE — into an rsyslog RainerScript config\nfile without neutralizing RainerScript syntax. A privileged (superuser) user can\ninject rsyslog directives, including an omprog action, causing arbitrary command\nexecution inside the control-plane rsyslog component. This allows disclosure of\nthe controller SECRET_KEY and database credentials, decryption of all stored\ncredentials, and full compromise of the control plane.","severity":{"version":"3.1","score":7.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-12","score":0.00795,"percentile":0.56908,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-96"],"published":"2026-09-23T19:40:11Z","modified":"2026-10-16T12:16:42Z","products":[{"vendor":"red hat","product":"red hat ansible automation platform 2"},{"vendor":"red hat","product":"red hat ansible automation platform 2.7"}],"references":[{"url":"https://access.redhat.com/errata/RHSA-2026:71177","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-85475","tags":["vdb-entry","x_refsource_REDHAT"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2528255","tags":["issue-tracking","x_refsource_REDHAT"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-85475"},{"url":"https://github.com/advisories/GHSA-wpwh-486h-5v3j"}],"sources":{"cve":[{"id":"CVE-2026-85475","title":"Automation-controller: automation-controller-container: automation-controller: rsyslog configuration injection via log_aggregator_* settings leads to remote code execution in the control-plane rsyslog component","description":"A flaw was found in the Ansible Automation Platform automation controller. The\nexternal logging (rsyslog) configuration is generated by interpolating\nuser-controlled settings — LOG_AGGREGATOR_HOST, LOG_AGGREGATOR_MAX_DISK_USAGE_PATH\nand LOG_AGGREGATOR_RSYSLOGD_ERROR_LOG_FILE — into an rsyslog RainerScript config\nfile without neutralizing RainerScript syntax. A privileged (superuser) user can\ninject rsyslog directives, including an omprog action, causing arbitrary command\nexecution inside the control-plane rsyslog component. This allows disclosure of\nthe controller SECRET_KEY and database credentials, decryption of all stored\ncredentials, and full compromise of the control plane.","status":"published","published":"2026-09-23T19:40:11.031Z","modified":"2026-10-16T11:52:46.492Z","cvss":[{"version":"3.1","score":7.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"cna"}],"cwes":["CWE-96"],"updated_at":"2026-11-02T14:19:52.016971Z"}],"euvd":[{"id":"EUVD-2026-85607","description":"A flaw was found in the Ansible Automation Platform automation controller. The\nexternal logging (rsyslog) configuration is generated by interpolating\nuser-controlled settings — LOG_AGGREGATOR_HOST, LOG_AGGREGATOR_MAX_DISK_USAGE_PATH\nand LOG_AGGREGATOR_RSYSLOGD_ERROR_LOG_FILE — into an rsyslog RainerScript config\nfile without neutralizing RainerScript syntax. A privileged (superuser) user can\ninject rsyslog directives, including an omprog action, causing arbitrary command\nexecution inside the control-plane rsyslog component. This allows disclosure of\nthe controller SECRET_KEY and database credentials, decryption of all stored\ncredentials, and full compromise of the control plane.","status":"published","published":"2026-09-23T19:40:11Z","modified":"2026-10-16T11:52:46Z","cvss":[{"version":"3.1","score":7.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T17:00:06.711534Z"}],"ghsa":[{"id":"GHSA-wpwh-486h-5v3j","title":"A flaw was found in the Ansible Automation Platform automation controller. The\nexternal logging ...","description":"A flaw was found in the Ansible Automation Platform automation controller. The\nexternal logging (rsyslog) configuration is generated by interpolating\nuser-controlled settings — LOG_AGGREGATOR_HOST, LOG_AGGREGATOR_MAX_DISK_USAGE_PATH\nand LOG_AGGREGATOR_RSYSLOGD_ERROR_LOG_FILE — into an rsyslog RainerScript config\nfile without neutralizing RainerScript syntax. A privileged (superuser) user can\ninject rsyslog directives, including an omprog action, causing arbitrary command\nexecution inside the control-plane rsyslog component. This allows disclosure of\nthe controller SECRET_KEY and database credentials, decryption of all stored\ncredentials, and full compromise of the control plane.","status":"published","published":"2026-09-23T21:30:58Z","modified":"2026-09-24T06:31:15Z","cvss":[{"version":"3.1","score":7.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-96"],"updated_at":"2026-11-02T15:12:21.685353Z"}],"nvd":[{"id":"CVE-2026-85475","description":"A flaw was found in the Ansible Automation Platform automation controller. The\nexternal logging (rsyslog) configuration is generated by interpolating\nuser-controlled settings — LOG_AGGREGATOR_HOST, LOG_AGGREGATOR_MAX_DISK_USAGE_PATH\nand LOG_AGGREGATOR_RSYSLOGD_ERROR_LOG_FILE — into an rsyslog RainerScript config\nfile without neutralizing RainerScript syntax. A privileged (superuser) user can\ninject rsyslog directives, including an omprog action, causing arbitrary command\nexecution inside the control-plane rsyslog component. This allows disclosure of\nthe controller SECRET_KEY and database credentials, decryption of all stored\ncredentials, and full compromise of the control plane.","status":"published","published":"2026-09-23T20:17:19.343Z","modified":"2026-10-16T12:16:42.06Z","cvss":[{"version":"3.1","score":7.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"secondary"}],"cwes":["CWE-96"],"updated_at":"2026-11-02T14:12:51.036099Z"}]}}