CVE-2026-84706 Code injection in Red Hat Ansible Automation Platform 2.5 for RHEL 8
A privileged user can inject environment variables to execute arbitrary code in the execution environment container via a flawed credential injector.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-84706?
CVE-2026-84706 is a high-severity code injection vulnerability in Red Hat Ansible Automation Platform 2.5 for RHEL 8, published on 23 Sep 2026. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
A flaw was found in Ansible Automation Platform's automation-controller. The custom Credential Type environment-variable injector validates variable names against a deny-list (an ANSIBLE_* prefix check plus a fixed ENV_BLOCKLIST) that omits process-hijacking loader variables such as BASH_ENV, ENV, LD_PRELOAD, LD_LIBRARY_PATH, PYTHONSTARTUP and GIT_SSH_COMMAND. Combined with the credential file injector, a privileged user can write an attacker-controlled script into the execution environment and point BASH_ENV at it, obtaining arbitrary code execution inside the execution-environment container for any job that attaches a credential of that type.
Weakness: CWE-184
Which versions are affected by CVE-2026-84706?
How do I fix CVE-2026-84706?
Apply the vendor's patch.
Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.
Is CVE-2026-84706 being exploited?
There is no known exploitation of CVE-2026-84706 in the wild and no public exploit code.
Sources
Also known as GHSA-5vrq-6q93-m3rf.