CVE-2026-84714

Awaiting Analysis Awaiting Analysis - Queue

Jinja Template Injection in Ansible Automation Controller

Publication date: 2026-09-23

Last updated on: 2026-09-24

Assigner: redhat-SADP

Description

A flaw was found in the automation-controller input-validation guard sanitize_jinja(). The function uses two regular expressions to reject user-supplied Jinja, but the patterns stop at the first interior '}' or '%' character, so a Jinja expression containing an inner brace (for example an empty dict) is accepted while remaining valid Jinja. Because sanitize_jinja() is the sole guard on several launch-time fields — ad-hoc command module_args, Machine-credential username / become_method / become_user, and inventory host names — a low-privileged user can inject Jinja that ansible-core evaluates in the execution environment. This enables execution of arbitrary commands in the execution environment (bypassing an administrator's AD_HOC_COMMANDS module allowlist) and disclosure of secrets belonging to credentials the attacker cannot read (by templating a co-attached credential's injected environment variables), across the credential access-control boundary.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-23

Last Modified

2026-09-24

Generated

2026-10-14

AI Q&A

2026-09-24

EPSS Evaluated

2026-10-12

NVD

CVE-2026-84714

EUVD

EUVD-2026-85605

Affected Vendors & Products

Vendor	Product	Version / Range
redhat	automation_controller	*
red_hat	ansible_automation_platform	From 2.5 (inc)
red_hat	ansible_automation_platform	From 2.6 (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-184	The product implements a protection mechanism that relies on a list of inputs (or properties of inputs) that are not allowed by policy or otherwise require other action to neutralize before additional processing takes place, but the list is incomplete.

Attack-Flow Graph

Executive Summary

This vulnerability is a template-injection flaw in the automation-controller of Red Hat Ansible Automation Platform. The issue stems from an incomplete input-validation function called sanitize_jinja() which uses flawed regular expressions to block Jinja template syntax in certain fields. These fields include ad-hoc command module arguments, machine credential fields, and host names. The regex patterns fail to detect Jinja expressions containing inner braces or percent signs, allowing malicious input to bypass filtering. This enables low-privileged users to inject executable Jinja templates that run within the execution environment.

The vulnerability is tracked under CWE-184 (Incomplete List of Disallowed Inputs) and has a CVSS v3 base score of 7.1. It allows attackers to bypass intended protections by exploiting incomplete input validation, enabling command execution and secret disclosure in restricted contexts.

Detection Guidance

Check for suspicious Jinja template injections in ad-hoc command module_args, machine credential fields (username, become_method, become_user), and inventory host names. Review job outputs for unexpected command execution or secret exposure. Use regex patterns to detect unfiltered '{{' or '{%' sequences in these fields.

Impact Analysis

A low-privileged user can exploit this vulnerability to execute arbitrary commands in the execution environment, bypassing an administrator's allowlist for ad-hoc commands. Additionally, it can lead to disclosure of secrets belonging to credentials the attacker cannot directly read by templating environment variables from co-attached credentials. This crosses credential access-control boundaries, potentially exposing sensitive data.

Compliance Impact

This vulnerability could lead to unauthorized command execution and secret disclosure, which may violate compliance requirements under GDPR (data protection) and HIPAA (healthcare data privacy). Unauthorized access to secrets or execution environments could result in data breaches or unauthorized processing of personal or health data.

Mitigation Strategies

Apply the latest patches from Red Hat for Ansible Automation Platform versions 2.5 and 2.6 via RHSA-2026:71114 and RHSA-2026:71113. Temporarily restrict low-privileged user access to sensitive fields until patched. Monitor job outputs for unauthorized command execution or secret disclosure.

Hi! I’m here to help you understand CVE-2026-84714. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70