{"answers":{"affected":"","exploited":"There is no known exploitation of CVE-2026-84706 in the wild and no public exploit code.","fix":"Apply the vendor's patch.","what":"CVE-2026-84706 is a high-severity code injection vulnerability in Red Hat Ansible Automation Platform 2.5 for RHEL 8, published on 23 Sep 2026. An attacker needs administrator access to exploit it, with no action from the victim."},"fix_prompt":"Check this codebase for CVE-2026-84706 and fix it if it is affected.\n\nWhat it is: CVE-2026-84706 is a high-severity code injection vulnerability in Red Hat Ansible Automation Platform 2.5 for RHEL 8, published on 23 Sep 2026. An attacker needs administrator access to exploit it, with no action from the victim.\nExploitation: There is no known exploitation of CVE-2026-84706 in the wild and no public exploit code.\n\nAffected product: Red Hat Ansible Automation Platform 2.5 for RHEL 8. No package-level version data is available, so check the vendor advisory linked from the reference page.\n\nTask:\n1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.\n2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.\n3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.\n4. Run the tests and summarise what changed and why.\n5. If nothing in the project is affected, say so and change nothing.\n\nReference: https://insights.sbomify.com/CVE-2026-84706/ (Markdown: https://insights.sbomify.com/CVE-2026-84706/index.md)","id":"CVE-2026-84706","markdown":"https://insights.sbomify.com/CVE-2026-84706/index.md","name":"CVE-2026-84706","record":{"aliases":["GHSA-5vrq-6q93-m3rf"],"analysis":{"component_type":"server_software","fix_type":"patch","impacts":["code_execution"],"network_reachable":"yes","non_default_config":false,"product_category":"Ansible Automation Platform","requires_auth":"high_privilege","summary":"A privileged user can inject environment variables to execute arbitrary code in the execution environment container via a flawed credential injector.","user_interaction":"not_required","vuln_class":"code_injection"},"analysis_generated_by":"qwen3.8-flash-next","assigner":"redhat","cpe":[],"cvss":{"score":7.6,"severity":"high","source":"cna","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:H/A:N","version":"3.1"},"cwes":[{"id":"CWE-184","name":"Incomplete List of Disallowed Inputs"}],"description":"A flaw was found in Ansible Automation Platform's automation-controller. The custom\nCredential Type environment-variable injector validates variable names against a\ndeny-list (an ANSIBLE_* prefix check plus a fixed ENV_BLOCKLIST) that omits\nprocess-hijacking loader variables such as BASH_ENV, ENV, LD_PRELOAD, LD_LIBRARY_PATH,\nPYTHONSTARTUP and GIT_SSH_COMMAND. Combined with the credential file injector, a\nprivileged user can write an attacker-controlled script into the execution environment\nand point BASH_ENV at it, obtaining arbitrary code execution inside the\nexecution-environment container for any job that attaches a credential of that type.","ecosystems":[],"exploits":{"exploitdb":0,"first_seen":null,"github_poc":0,"max_poc_stars":null,"metasploit":0,"nuclei":0,"refs":[],"tier":"none_known"},"has_fix":true,"headline":"Code injection in Red Hat Ansible Automation Platform 2.5 for RHEL 8","id":"CVE-2026-84706","indexable":true,"kev":null,"kind":"cve","links":{"ecosystem":null,"product":null,"products":[],"type":"code_injection","year":"2026"},"n_packages":0,"n_references":6,"next":{"headline":"Information disclosure in Red Hat Ansible Automation Platform 2.5 for RHEL 8","id":"CVE-2026-84712"},"packages":[],"prev":{"headline":"facefusion before 3.7.0 Path Traversal via Job Identifier","id":"CVE-2026-84702"},"products":["Red Hat Ansible Automation Platform 2.5 for RHEL 8","Red Hat Ansible Automation Platform 2.5 for RHEL 9","Red Hat Ansible Automation Platform 2.6","Red Hat Ansible Automation Platform 2.6 for RHEL 9","Red Hat Ansible Automation Platform 2.7"],"published":"2026-09-23","related":[],"sources":[{"class":"attribution","licence":"CVE Terms of Use (MITRE)","name":"CVE List","prefix":"CVE"},{"class":"attribution","licence":"CWE Terms of Use","name":"CWE (MITRE)"},{"class":"attribution","licence":"FIRST CVSS licence","name":"CVSS (FIRST)"}],"ssvc":{"automatable":"no","exploitation":"none","technical_impact":"partial"},"state":"PUBLISHED","updated":"2026-10-16","vendors":["Red Hat"]},"summary":"A privileged user can inject environment variables to execute arbitrary code in the execution environment container via a flawed credential injector.","url":"https://insights.sbomify.com/CVE-2026-84706/"}