CVE-2026-84502
Awaiting Analysis Awaiting Analysis - Queue

Command Injection in Red Hat Ansible Automation Platform

Publication date: 2026-09-23

Last updated on: 2026-09-23

Assigner: redhat-SADP

Description
A flaw was found in Red Hat Ansible Automation Platform's automation- controller. The Project scm_url field is not validated against values that begin with a dash and is stored and passed verbatim to the git SCM module. Because the module runs git ls-remote with the URL as a positional argument and without a "--" separator, a git project URL such as "--upload-pack=<command>:x" is interpreted by git as the --upload-pack option and executed via a shell. A user with permission to create or modify a project in a single organization can thereby execute arbitrary commands on the control-plane task pod, with output reflected through the project update stdout endpoint, leading to cross-tenant compromise and in-cluster lateral movement

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-23
Last Modified
2026-09-23
Generated
2026-09-24
AI Q&A
2026-09-23
EPSS Evaluated
N/A
NVD
CVE-2026-84502
EUVD
EUVD-2026-85560

Affected Vendors & Products

Showing 3 associated CPEs
Vendor Product Version / Range
red_hat ansible_automation_platform *
red_hat ansible_automation_platform 2.4
red_hat ansible_automation_platform 2.6

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-88 The product constructs a string for a command to be executed by a separate component in another control sphere, but it does not properly delimit the intended arguments, options, or switches within that command string.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in Red Hat Ansible Automation Platform's automation-controller allows a user with project modification permissions to inject malicious git commands via the scm_url field. By starting the URL with a dash, the git command interprets it as an option rather than a URL, enabling arbitrary command execution on the control-plane task pod. This can lead to cross-tenant compromise and lateral movement within the cluster.

Detection Guidance

Check Ansible Automation Platform logs for project update failures or unusual stdout output. Inspect git URLs in projects for values starting with dashes. Review task pod logs for unexpected git command execution.

Impact Analysis

If you are a user with permission to create or modify projects in Ansible Automation Platform, an attacker could exploit this to execute arbitrary commands on the control-plane task pod. This may result in unauthorized access to sensitive data, disruption of services, or further compromise of the cluster environment.

Compliance Impact

This vulnerability could lead to unauthorized data access or exfiltration, violating GDPR's data protection requirements and HIPAA's safeguards for protected health information. Organizations using this platform may face compliance breaches, legal penalties, and reputational damage if exploited.

Mitigation Strategies

Update Ansible Automation Platform to the latest patched version. Restrict project creation/modification permissions to trusted users. Monitor project update logs for suspicious activity.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-84502. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart