Vulnerability · Published Sep 23, 2026 · Assigned by redhat
CVE-2026-84724Automation-controller: automation-controller: systemjob extra_vars.days argument injection into uncontainerized control-plane awx-manage process
Medium 6.6
In plain English
A medium-severity argument injection in Red Hat Ansible Automation Platform 2.5 for RHEL 8 from Red Hat. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 22% of all known vulnerabilities).
Official description
An argument-injection flaw was found in the Ansible Automation Platform automation-controller system-job subsystem. The system-job template launch endpoint stores a user-supplied "days" variable without running the integer validation defined elsewhere for that field, and the dispatcher flattens the management-command argument list into a single string with spaces before the job runner re-splits it, so spaces in the value become additional command-line arguments. Because system jobs are executed in-process on the control node without the container isolation applied to all other job types, an authenticated user with superuser privileges can inject arbitrary arguments — including Python's path option — into the control-plane awx-manage process, controlling its argument vector and the first entry of its module search path. Full remote code execution requires an additional import gadget that is not present in the current management commands, so the demonstrated impact is argument injection with control of the process search path rather than confirmed code execution.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Red Hat | Red Hat Ansible Automation Platform 2.5 for RHEL 8 | see references |
| Red Hat | Red Hat Ansible Automation Platform 2.5 for RHEL 9 | see references |
| Red Hat | Red Hat Ansible Automation Platform 2.6 for RHEL 9 | see references |
| Red Hat | Red Hat Ansible Automation Platform 2.6 | see references |
| Red Hat | Red Hat Ansible Automation Platform 2.7 | see references |
Weakness: CWE-88 · Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:L
References
- RHSA-2026:71113 vendor-advisory, x_refsource_REDHAT
- RHSA-2026:71114 vendor-advisory, x_refsource_REDHAT
- RHSA-2026:71177 vendor-advisory, x_refsource_REDHAT
- RHSA-2026:71179 vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/security/cve/CVE-2026-84724 vdb-entry, x_refsource_REDHAT
- RHBZ#2527222 issue-tracking, x_refsource_REDHAT