CVE-2026-84724

Awaiting Analysis Awaiting Analysis - Queue

Argument Injection in Ansible Automation Platform

Publication date: 2026-09-23

Last updated on: 2026-09-26

Assigner: redhat-SADP

Description

An argument-injection flaw was found in the Ansible Automation Platform automation-controller system-job subsystem. The system-job template launch endpoint stores a user-supplied "days" variable without running the integer validation defined elsewhere for that field, and the dispatcher flattens the management-command argument list into a single string with spaces before the job runner re-splits it, so spaces in the value become additional command-line arguments. Because system jobs are executed in-process on the control node without the container isolation applied to all other job types, an authenticated user with superuser privileges can inject arbitrary arguments — including Python's path option — into the control-plane awx-manage process, controlling its argument vector and the first entry of its module search path. Full remote code execution requires an additional import gadget that is not present in the current management commands, so the demonstrated impact is argument injection with control of the process search path rather than confirmed code execution.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-23

Last Modified

2026-09-26

Generated

2026-10-14

AI Q&A

2026-09-24

EPSS Evaluated

2026-10-12

NVD

CVE-2026-84724

EUVD

EUVD-2026-85616

Affected Vendors & Products

Vendor	Product	Version / Range
redhat	ansible_automation_platform	*
redhat	ansible_automation_platform	2.5
redhat	ansible_automation_platform	2.6

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-88	The product constructs a string for a command to be executed by a separate component in another control sphere, but it does not properly delimit the intended arguments, options, or switches within that command string.

Attack-Flow Graph

Executive Summary

CVE-2026-84724 is an argument-injection flaw in the Ansible Automation Platform automation-controller system-job subsystem. The vulnerability occurs because the system-job template launch endpoint stores a user-supplied 'days' variable without integer validation. The dispatcher then flattens the management-command argument list into a single string with spaces, which the job runner re-splits. Spaces in the value become additional command-line arguments. Since system jobs run in-process on the control node without container isolation, an authenticated superuser can inject arbitrary arguments into the awx-manage process, controlling its argument vector and module search path.

Detection Guidance

To detect this vulnerability, check for unauthorized modifications to the awx-manage process arguments or unexpected command-line arguments in system jobs. Review logs for system jobs with malformed 'days' values or suspicious extra_vars. Use commands like 'ps aux | grep awx-manage' to inspect running processes for unusual arguments.

Impact Analysis

An attacker with superuser privileges could inject arguments into the awx-manage process, potentially controlling its behavior or accessing sensitive data like SECRET_KEY and database credentials. While full remote code execution is not confirmed, the attacker could manipulate the process search path or pass malicious options. Exploitation requires superuser access, limiting the risk to authorized administrators.

Compliance Impact

This vulnerability could lead to unauthorized access or manipulation of sensitive data processed by the Ansible Automation Platform, potentially violating GDPR (data protection) or HIPAA (health information privacy) requirements. Unauthorized command injection may result in data breaches or integrity issues, requiring organizations to assess and mitigate risks to maintain compliance.

Mitigation Strategies

Apply the latest security patches from Red Hat for Ansible Automation Platform versions 2.5 and 2.6. Ensure the 'days' variable is validated as an integer before processing. Restrict superuser access to system-job templates. Monitor for unusual awx-manage process arguments or system job behavior.

Hi! I’m here to help you understand CVE-2026-84724. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70