Environment Variable Injection Vulnerability in Ansible Automation Platform by Red Hat
CVE-2026-84706
Key Information:
- Vendor
Red Hat
- Status
- Vendor
- CVE Published:
- 23 September 2026
What is CVE-2026-84706?
A vulnerability exists in the Ansible Automation Platform's automation-controller where the custom Credential Type environment-variable injector inadequately validates variable names against a defined deny-list. This oversight fails to encompass critical process-hijacking loader environment variables, allowing a privileged user to execute unauthorized scripts within the execution environment. By manipulating the BASH_ENV variable, attackers could gain the ability to execute arbitrary code inside the execution-environment container during job executions that utilize specific credential types, posing significant risks to system integrity and security.
Affected Version(s)
Red Hat Ansible Automation Platform 2.5 for RHEL 8 0:4.6.33-1.el8ap
Red Hat Ansible Automation Platform 2.5 for RHEL 9 0:4.6.33-1.el9ap
Red Hat Ansible Automation Platform 2.6 1789673739