Remote Code Execution Risk in Ansible Automation Controller by Red Hat

CVE-2026-71464

What is CVE-2026-71464?

The vulnerability in Ansible Automation Controller stems from a missing validation check in the LaunchConfigurationBaseSerializer's scm_branch field. Unlike other serializers, this gap allows the acceptance of potentially harmful input, leading to a security risk of remote code execution. Although a runtime guard prevents immediate exploitation, the lack of API validation creates a significant security concern. This issue emphasizes the need for robust validation checks to prevent unauthorized command execution via malicious scm_branch inputs.

References