Log in Start free

Vulnerability · Published Sep 23, 2026 · Assigned by redhat

CVE-2026-84706Automation-controller: automation-controller-container: automation-controller: credential type env-injector deny-list omits process-hijacking variables (bash_env/ld_preload) allowing code execution in the execution environment

High 7.6

In plain English

A high-severity security flaw in Red Hat Ansible Automation Platform 2.5 for RHEL 8 from Red Hat. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 24% of all known vulnerabilities).

Severity (CVSS 3.1)7.6High
Exploit odds (30 days)0.3%top 76.4% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

A flaw was found in Ansible Automation Platform's automation-controller. The custom Credential Type environment-variable injector validates variable names against a deny-list (an ANSIBLE_* prefix check plus a fixed ENV_BLOCKLIST) that omits process-hijacking loader variables such as BASH_ENV, ENV, LD_PRELOAD, LD_LIBRARY_PATH, PYTHONSTARTUP and GIT_SSH_COMMAND. Combined with the credential file injector, a privileged user can write an attacker-controlled script into the execution environment and point BASH_ENV at it, obtaining arbitrary code execution inside the execution-environment container for any job that attaches a credential of that type.

Affected products (as reported)

VendorProductVersions
Red Hat Red Hat Ansible Automation Platform 2.5 for RHEL 8 see references
Red Hat Red Hat Ansible Automation Platform 2.5 for RHEL 8 see references
Red Hat Red Hat Ansible Automation Platform 2.5 for RHEL 9 see references
Red Hat Red Hat Ansible Automation Platform 2.5 for RHEL 9 see references
Red Hat Red Hat Ansible Automation Platform 2.6 for RHEL 9 see references
Red Hat Red Hat Ansible Automation Platform 2.6 for RHEL 9 see references
Red Hat Red Hat Ansible Automation Platform 2.6 see references
Red Hat Red Hat Ansible Automation Platform 2.7 see references

Weakness: CWE-184 · Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:H/A:N

References