Argument Injection Vulnerability in Ansible Automation Platform from Red Hat
CVE-2026-84724
Key Information:
- Vendor
Red Hat
- Status
- Vendor
- CVE Published:
- 23 September 2026
What is CVE-2026-84724?
An argument injection flaw exists in the system-job subsystem of Ansible Automation Platform's automation-controller. This vulnerability arises from the improper handling of a user-supplied 'days' variable, lacking appropriate integer validation. Consequently, when the dispatcher processes command arguments, it inadvertently allows an authenticated superuser to inject arbitrary arguments into the control-plane process. Although the primary concern is the manipulation of the command argument vector, full remote code execution is not feasible without additional conditions being met. Therefore, while direct code execution is not currently demonstrable, the risk of argument manipulation remains significant.
Affected Version(s)
Red Hat Ansible Automation Platform 2.5 for RHEL 8 0:4.6.33-1.el8ap
Red Hat Ansible Automation Platform 2.5 for RHEL 9 0:4.6.33-1.el9ap
Red Hat Ansible Automation Platform 2.6 1789673739