Input Validation Flaw in Ansible Automation Controller by Red Hat
CVE-2026-84714
Key Information:
- Vendor
Red Hat
- Status
- Vendor
- CVE Published:
- 23 September 2026
What is CVE-2026-84714?
A flaw exists in the input validation mechanism of the Ansible Automation Controller where user-supplied Jinja expressions may bypass security safeguards. Specifically, the guard function sanitize_jinja() relies on regular expressions that fail to fully validate nested braces, leading to scenarios where a low-privileged user can inject malicious Jinja code. This code can then be executed within the execution environment, allowing attackers to run arbitrary commands and potentially expose sensitive credentials by accessing environment variables linked to other credentials, thus breaching access control measures.
Affected Version(s)
Red Hat Ansible Automation Platform 2.5 for RHEL 8 0:4.6.33-1.el8ap
Red Hat Ansible Automation Platform 2.5 for RHEL 9 0:4.6.33-1.el9ap
Red Hat Ansible Automation Platform 2.6 1789673739