CVE-2026-84706

Received Received - Intake

Code Execution in Ansible Automation Platform via Credential Injection

Publication date: 2026-09-23

Last updated on: 2026-09-23

Assigner: redhat-SADP

Description

A flaw was found in Ansible Automation Platform's automation-controller. The custom Credential Type environment-variable injector validates variable names against a deny-list (an ANSIBLE_* prefix check plus a fixed ENV_BLOCKLIST) that omits process-hijacking loader variables such as BASH_ENV, ENV, LD_PRELOAD, LD_LIBRARY_PATH, PYTHONSTARTUP and GIT_SSH_COMMAND. Combined with the credential file injector, a privileged user can write an attacker-controlled script into the execution environment and point BASH_ENV at it, obtaining arbitrary code execution inside the execution-environment container for any job that attaches a credential of that type.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-23

Last Modified

2026-09-23

Generated

2026-09-24

AI Q&A

2026-09-24

EPSS Evaluated

N/A

NVD

CVE-2026-84706

EUVD

EUVD-2026-85638

Affected Vendors & Products

Vendor	Product	Version / Range
redhat	ansible_automation_platform	-
red_hat	ansible_automation_platform	to 2.5 (inc)
red_hat	ansible_automation_platform	to 2.6 (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-184	The product implements a protection mechanism that relies on a list of inputs (or properties of inputs) that are not allowed by policy or otherwise require other action to neutralize before additional processing takes place, but the list is incomplete.

Attack-Flow Graph

Executive Summary

This vulnerability is in Ansible Automation Platform's automation-controller. The Credential Type environment-variable injector fails to block certain process-hijacking environment variables like BASH_ENV and LD_PRELOAD. Attackers with high privileges can exploit this to inject malicious scripts into the execution environment, leading to arbitrary code execution within the container.

Detection Guidance

To detect this vulnerability, check for custom Credential Types in Ansible Automation Platform that use environment variable injection. Review deny-lists for missing process-hijacking variables like BASH_ENV, LD_PRELOAD, or ENV. Inspect job execution environments for unexpected scripts loaded via these variables.

Impact Analysis

If you are a privileged user in Ansible Automation Platform, an attacker could gain control over the execution environment. This could expose secrets from other credentials, allow access to inventory hosts, and compromise job integrity. The attack requires high privileges but can lead to significant security breaches.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating compliance requirements like GDPR (data protection) and HIPAA (health information privacy). Unauthorized code execution may result in data breaches, exposing personal or health information and leading to regulatory penalties.

Mitigation Strategies

Apply the provided patches RHSA-2026:71113 for version 2.6 or RHSA-2026:71114 for version 2.5. Replace the deny-list with an allow-list for environment variables. Restrict creation of custom Credential Types to trusted administrators only.

Hi! I’m here to help you understand CVE-2026-84706. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70