« Volver al listado

CVE-2026-84724

Estado: Pendiente de análisisMedia (6.6)—

An argument-injection flaw was found in the Ansible Automation Platform automation-controller system-job subsystem. The system-job template launch endpoint stores a user-supplied "days" variable without running the integer validation defined elsewhere for that field, and the dispatcher flattens the management-command argument list into a single string with spaces before the job runner re-splits it, so spaces in the value become additional command-line arguments.

Leer descripción completaMostrar menos

Because system jobs are executed in-process on the control node without the container isolation applied to all other job types, an authenticated user with superuser privileges can inject arbitrary arguments — including Python's path option — into the control-plane awx-manage process, controlling its argument vector and the first entry of its module search path. Full remote code execution requires an additional import gadget that is not present in the current management commands, so the demonstrated impact is argument injection with control of the process search path rather than confirmed code execution.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

🎯 Técnicas ATT&CK

Cómo se explota esta vulnerabilidad y qué consigue el atacante, en el lenguaje de MITRE ATT&CK.

Inyección de argumentos en endpoint de servicios remotos (T1210) por usuario autenticado con privilegios altos. Impactos: ejecución de comandos Python (T1059.007) e impersonación/escalada de privilegios via manipulación del path (T1548.004).

Inferido por nuestro agente de análisis a partir de la descripción oficial, el vector CVSS y la CWE, y comprobado por un supervisor. Puede contener errores.

🛡️ Mitigaciones ATT&CK que cubren estas técnicas

Execution PreventionDisable or Remove Feature or ProgramVulnerability ScanningThreat Intelligence ProgramRestrict Web-Based ContentPrivileged Account Management

Tecnologías afectadas (1)

⚠ Inferidas por IA a partir de la descripción — NVD aún no ha analizado esta CVE; no son CPE verificados.

Redhat — Ansible Automation PlatformAI

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2026-84724",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-84724",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2026-09-26T22:46:52.225556Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "secalert@redhat.com",
        "cvssData": {
          "scope": "CHANGED",
          "version": "3.1",
          "baseScore": 6.6,
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:L",
          "integrityImpact": "LOW",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "LOW",
          "privilegesRequired": "HIGH",
          "confidentialityImpact": "LOW"
        },
        "impactScore": 3.7,
        "exploitabilityScore": 2.3
      }
    ]
  },
  "affected": [
    {
      "source": "secalert@redhat.com",
      "affectedData": [
        {
          "cpes": [
            "cpe:/a:redhat:ansible_automation_platform:2.5::el8",
            "cpe:/a:redhat:ansible_automation_platform:2.5::el9",
            "cpe:/a:redhat:ansible_automation_platform_developer:2.5::el8",
            "cpe:/a:redhat:ansible_automation_platform_developer:2.5::el9",
            "cpe:/a:redhat:ansible_automation_platform_inside:2.5::el8",
            "cpe:/a:redhat:ansible_automation_platform_inside:2.5::el9"
          ],
          "vendor": "Red Hat",
          "product": "Red Hat Ansible Automation Platform 2.5 for RHEL 8",
          "versions": [
            {
              "status": "unaffected",
              "version": "0:4.6.33-1.el8ap",
              "lessThan": "*",
              "versionType": "rpm"
            }
          ],
          "packageName": "automation-controller",
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "defaultStatus": "affected"
        },
        {
          "cpes": [
            "cpe:/a:redhat:ansible_automation_platform:2.5::el8",
            "cpe:/a:redhat:ansible_automation_platform:2.5::el9",
            "cpe:/a:redhat:ansible_automation_platform_developer:2.5::el8",
            "cpe:/a:redhat:ansible_automation_platform_developer:2.5::el9",
            "cpe:/a:redhat:ansible_automation_platform_inside:2.5::el8",
            "cpe:/a:redhat:ansible_automation_platform_inside:2.5::el9"
          ],
          "vendor": "Red Hat",
          "product": "Red Hat Ansible Automation Platform 2.5 for RHEL 9",
          "versions": [
            {
              "status": "unaffected",
              "version": "0:4.6.33-1.el9ap",
              "lessThan": "*",
              "versionType": "rpm"
            }
          ],
          "packageName": "automation-controller",
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "defaultStatus": "affected"
        },
        {
          "cpes": [
            "cpe:/a:redhat:ansible_automation_platform:2.6::el10",
            "cpe:/a:redhat:ansible_automation_platform:2.6::el9",
            "cpe:/a:redhat:ansible_automation_platform_developer:2.6::el10",
            "cpe:/a:redhat:ansible_automation_platform_developer:2.6::el9",
            "cpe:/a:redhat:ansible_automation_platform_inside:2.6::el9"
          ],
          "vendor": "Red Hat",
          "product": "Red Hat Ansible Automation Platform 2.6 for RHEL 9",
          "versions": [
            {
              "status": "unaffected",
              "version": "0:4.7.17-1.el9ap",
              "lessThan": "*",
              "versionType": "rpm"
            }
          ],
          "packageName": "automation-controller",
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "defaultStatus": "affected"
        },
        {
          "cpes": [
            "cpe:/a:redhat:ansible_automation_platform:2.6::el9"
          ],
          "vendor": "Red Hat",
          "product": "Red Hat Ansible Automation Platform 2.6",
          "versions": [
            {
              "status": "unaffected",
              "version": "1789673739",
              "lessThan": "*",
              "versionType": "rpm"
            }
          ],
          "packageName": "ansible-automation-platform-26/controller-rhel9",
          "collectionURL": "https://catalog.redhat.com/software/containers/",
          "defaultStatus": "affected"
        },
        {
          "cpes": [
            "cpe:/a:redhat:ansible_automation_platform:2.7::el9"
          ],
          "vendor": "Red Hat",
          "product": "Red Hat Ansible Automation Platform 2.7",
          "versions": [
            {
              "status": "unaffected",
              "version": "1789580684",
              "lessThan": "*",
              "versionType": "rpm"
            }
          ],
          "packageName": "ansible-automation-platform-27/controller-rhel9",
          "collectionURL": "https://catalog.redhat.com/software/containers/",
          "defaultStatus": "affected"
        }
      ]
    }
  ],
  "published": "2026-09-23T20:17:19.033",
  "references": [
    {
      "url": "https://access.redhat.com/errata/RHSA-2026:71113",
      "source": "secalert@redhat.com"
    },
    {
      "url": "https://access.redhat.com/errata/RHSA-2026:71114",
      "source": "secalert@redhat.com"
    },
    {
      "url": "https://access.redhat.com/errata/RHSA-2026:71177",
      "source": "secalert@redhat.com"
    },
    {
      "url": "https://access.redhat.com/errata/RHSA-2026:71179",
      "source": "secalert@redhat.com"
    },
    {
      "url": "https://access.redhat.com/security/cve/CVE-2026-84724",
      "source": "secalert@redhat.com"
    },
    {
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2527222",
      "source": "secalert@redhat.com"
    }
  ],
  "vulnStatus": "Awaiting Analysis",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "secalert@redhat.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-88"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "An argument-injection flaw was found in the Ansible Automation Platform automation-controller\nsystem-job subsystem. The system-job template launch endpoint stores a user-supplied \"days\"\nvariable without running the integer validation defined elsewhere for that field, and the\ndispatcher flattens the management-command argument list into a single string with spaces before\nthe job runner re-splits it, so spaces in the value become additional command-line arguments.\nBecause system jobs are executed in-process on the control node without the container isolation\napplied to all other job types, an authenticated user with superuser privileges can inject\narbitrary arguments — including Python's path option — into the control-plane awx-manage process,\ncontrolling its argument vector and the first entry of its module search path. Full remote code\nexecution requires an additional import gadget that is not present in the current management\ncommands, so the demonstrated impact is argument injection with control of the process search\npath rather than confirmed code execution."
    }
  ],
  "lastModified": "2026-09-26T23:16:38.090",
  "sourceIdentifier": "secalert@redhat.com"
}