CVE-2026-84714
HighCVSS 7.1Summary
In automation-controller, the sanitize_jinja() function uses regular expressions that stop at the first interior '}' or '%' character, so a Jinja expression containing an inner brace (e.g., an empty dict) is accepted while remaining valid Jinja. Because sanitize_jinja() is the sole guard on several launch-time fields, a low-privileged user can inject Jinja that ansible-core evaluates in the execution environment.
Risk Assessment
This enables execution of arbitrary commands in the execution environment (bypassing an administrator's AD_HOC_COMMANDS module allowlist) and disclosure of secrets belonging to credentials the attacker cannot read.
Recommendation
Update Ansible Automation Platform automation controller to a patched version or apply vendor-recommended mitigations.
Other vulnerabilities in Ansible Automation Platform automation controller
See all- CVE-2026-85475High
In Ansible Automation Platform automation controller, the external logging (rsyslog) configuration is generated by interpolating user-controlled settings into an rsyslog RainerScript config file without neutralizing RainerScript syntax. A privileged user can inject rsyslog directives, including an omprog action, causing arbitrary command execution inside the control-plane rsyslog component.
- CVE-2026-84724Medium
An argument-injection flaw exists in the Ansible Automation Platform automation-controller system-job subsystem. The system-job template launch endpoint stores a user-supplied "days" variable without integer validation, and the dispatcher flattens the management-command argument list into a single space-separated string, so spaces become additional arguments. An authenticated superuser can inject arbitrary arguments, including Python's path option, into the awx-manage process.
- CVE-2026-84721Medium
A server-side request forgery flaw exists in the Ansible Automation Platform automation-controller email notification backend. The backend passes the user-supplied SMTP host and port from a notification template directly to the SMTP client without validating that the target is not an internal, loopback, link-local, or reserved address. An authenticated user with organization notification-admin permission can create a template pointing at an arbitrary internal address and trigger a test, opening a raw TCP connection.
- CVE-2026-84720Medium
In Ansible Automation Platform automation-controller, the WorkflowJobNode.ancestor_artifacts database column, storing raw merged set_stats artifacts propagated between workflow nodes, is not wrapped in prevent_search() and is accepted for arbitrary field lookups by the REST filter backend, even though it is omitted from the API serializer. Because the column is persisted before Ansible's no_log masking is applied, a user with read access to a workflow can use the result count as an oracle to recover, character by character, values marked no_log.
- CVE-2026-84718Medium
In Ansible Automation Platform automation-controller, in the shipped production configuration, the Controller trusts the client-supplied X-Forwarded-For header as the request's client IP without verifying it originated from a trusted proxy, and selects the leftmost (attacker-controlled) header value. An attacker can forge the source IP address recorded in the Controller's audit and access logs.
- CVE-2026-84717Medium
In Ansible Automation Platform automation-controller, the unauthenticated Bitbucket Data Center webhook receiver skips HMAC signature verification for diagnostics:ping events after looking up the target template, returning HTTP 200 for a template with a Bitbucket DC webhook configured and HTTP 403 otherwise. An unauthenticated remote attacker can use this response discrepancy as an oracle to enumerate which Job Template and Workflow Job Template IDs have Bitbucket DC webhooks configured, without knowing the secret webhook_key.
- CVE-2026-84706High
In Ansible Automation Platform automation-controller, the custom Credential Type environment-variable injector validates variable names against a deny-list that omits process-hijacking loader variables such as BASH_ENV, ENV, LD_PRELOAD, LD_LIBRARY_PATH, PYTHONSTARTUP and GIT_SSH_COMMAND. Combined with the credential file injector, a privileged user can write an attacker-controlled script into the execution environment and point BASH_ENV at it.
- CVE-2026-84691High
In Red Hat Ansible Automation Platform's automation-controller, the setting that formats the log message for API 4XX errors is an administrator-controlled Python format-string template rendered with a live user object as an argument. An administrator can craft a template that walks from the user object into the application settings and reads the Django secret key and the database password, and the formatted message is written to a logger that can be forwarded to an external log aggregator.
- CVE-2026-84683High
In Red Hat Ansible Automation Platform's automation-controller, the HTML view of job, ad hoc command, project update, and inventory update standard output escapes HTML metacharacters but does not remove ANSI terminal escape sequences before conversion to HTML. An ANSI OSC 8 hyperlink sequence in the output is expanded into an HTML anchor whose href is not scheme-filtered or escaped, so a low-privileged user can embed a javascript: link rendered into a text/html response with no Content-Security-Policy.
Original NVD description (English source)
A flaw was found in the automation-controller input-validation guard sanitize_jinja(). The function uses two regular expressions to reject user-supplied Jinja, but the patterns stop at the first interior '}' or '%' character, so a Jinja expression containing an inner brace (for example an empty dict) is accepted while remaining valid Jinja. Because sanitize_jinja() is the sole guard on several launch-time fields — ad-hoc command module_args, Machine-credential username / become_method / become_user, and inventory host names — a low-privileged user can inject Jinja that ansible-core evaluates in the execution environment. This enables execution of arbitrary commands in the execution environment (bypassing an administrator's AD_HOC_COMMANDS module allowlist) and disclosure of secrets belonging to credentials the attacker cannot read (by templating a co-attached credential's injected environment variables), across the credential access-control boundary.