{"id":"CVE-2026-84724","title":"An argument-injection flaw was found in the Ansible Automation Platform automation-controller\nsystem-job subsystem","summary":"An argument-injection flaw was found in the Ansible Automation Platform automation-controller\nsystem-job subsystem. The system-job template launch endpoint stores a user-supplied \"days\"\nvariable without running the integer validation def…","severity":"medium","cvss":6.6,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:L","cwe":["CWE-88"],"vendor":"Red Hat","product":"automation-controller","affected":["automation-controller (all versions)","automation-controller (all versions)","automation-controller (all versions)","ansible-automation-platform-26/controller-rhel9 (all versions)","ansible-automation-platform-27/controller-rhel9 (all versions)"],"patched":["ansible_automation_platform_2_5_for_rhel 8","ansible_automation_platform_2_5_for_rhel 9","ansible_automation_platform_2_6_for_rhel 9","ansible_automation_platform 2.6","ansible_automation_platform 2.7"],"published":"2026-09-23","updated":"2026-09-24","sourceUpdated":"2026-09-24T07:16:34.653","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-84724","references":[{"url":"https://access.redhat.com/errata/RHSA-2026:71113","label":"secalert@redhat.com"},{"url":"https://access.redhat.com/errata/RHSA-2026:71114","label":"secalert@redhat.com"},{"url":"https://access.redhat.com/errata/RHSA-2026:71177","label":"secalert@redhat.com"},{"url":"https://access.redhat.com/errata/RHSA-2026:71179","label":"secalert@redhat.com"},{"url":"https://access.redhat.com/security/cve/CVE-2026-84724","label":"secalert@redhat.com"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2527222","label":"secalert@redhat.com"},{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-84724.json"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-84724"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-84724"}],"tags":["nvd","cve.org","csaf","vex","red-hat"],"ingestedAt":"2026-09-23T20:32:10.754Z","slug":"CVE-2026-84724","body":"## Overview\n\nAn argument-injection flaw was found in the Ansible Automation Platform automation-controller\nsystem-job subsystem. The system-job template launch endpoint stores a user-supplied \"days\"\nvariable without running the integer validation defined elsewhere for that field, and the\ndispatcher flattens the management-command argument list into a single string with spaces before\nthe job runner re-splits it, so spaces in the value become additional command-line arguments.\nBecause system jobs are executed in-process on the control node without the container isolation\napplied to all other job types, an authenticated user with superuser privileges can inject\narbitrary arguments — including Python's path option — into the control-plane awx-manage process,\ncontrolling its argument vector and the first entry of its module search path. Full remote code\nexecution requires an additional import gadget that is not present in the current management\ncommands, so the demonstrated impact is argument injection with control of the process search\npath rather than confirmed code execution.\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.\n\n## Vendor advisories\n\n- **RHSA-2026:71114** · Red Hat · fixed in: Red Hat Ansible Automation Platform 2.5 for RHEL 8, Red Hat Ansible Automation Platform 2.5 for RHEL 9 · released 2026-09-23 · [advisory](https://access.redhat.com/errata/RHSA-2026:71114)\n- **RHSA-2026:71113** · Red Hat · fixed in: Red Hat Ansible Automation Platform 2.6 for RHEL 9 · released 2026-09-23 · [advisory](https://access.redhat.com/errata/RHSA-2026:71113)\n- **RHSA-2026:71179** · Red Hat · fixed in: Red Hat Ansible Automation Platform 2.6 · released 2026-09-23 · [advisory](https://access.redhat.com/errata/RHSA-2026:71179)\n- **RHSA-2026:71177** · Red Hat · fixed in: Red Hat Ansible Automation Platform 2.7 · released 2026-09-23 · [advisory](https://access.redhat.com/errata/RHSA-2026:71177)","depth":"sunlit","depthScore":36,"depthScoreParts":{"impact":36.3,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}