Vulnerability · Published Sep 23, 2026 · Assigned by redhat

CVE-2026-85475Automation-controller: automation-controller-container: automation-controller: rsyslog configuration injection via log_aggregator_* settings leads to remote code execution in the control-plane rsyslog component

High 7.2

In plain English

A high-severity security flaw in Red Hat Ansible Automation Platform 2 from Red Hat. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.8% (higher than 57% of all known vulnerabilities).

Severity (CVSS 3.1)7.2High

Exploit odds (30 days)0.8%top 43.4% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

A flaw was found in the Ansible Automation Platform automation controller. The external logging (rsyslog) configuration is generated by interpolating user-controlled settings — LOG_AGGREGATOR_HOST, LOG_AGGREGATOR_MAX_DISK_USAGE_PATH and LOG_AGGREGATOR_RSYSLOGD_ERROR_LOG_FILE — into an rsyslog RainerScript config file without neutralizing RainerScript syntax. A privileged (superuser) user can inject rsyslog directives, including an omprog action, causing arbitrary command execution inside the control-plane rsyslog component. This allows disclosure of the controller SECRET_KEY and database credentials, decryption of all stored credentials, and full compromise of the control plane.

Affected products (as reported)

Vendor	Product	Versions
Red Hat	Red Hat Ansible Automation Platform 2.7	see references
Red Hat	Red Hat Ansible Automation Platform 2	see references
Red Hat	Red Hat Ansible Automation Platform 2	see references

Weakness: CWE-96 · Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

References

RHSA-2026:71177 vendor-advisory, x_refsource_REDHAT
https://access.redhat.com/security/cve/CVE-2026-85475 vdb-entry, x_refsource_REDHAT
RHBZ#2528255 issue-tracking, x_refsource_REDHAT