CVE-2026-84714 Code injection in Red Hat Ansible Automation Platform 2.5 for RHEL 8
Low-privileged users can inject Jinja templates to execute arbitrary commands and read secrets in the Ansible execution environment.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-84714?
CVE-2026-84714 is a high-severity code injection vulnerability in Red Hat Ansible Automation Platform 2.5 for RHEL 8, published on 23 Sep 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
A flaw was found in the automation-controller input-validation guard sanitize_jinja(). The function uses two regular expressions to reject user-supplied Jinja, but the patterns stop at the first interior '}' or '%' character, so a Jinja expression containing an inner brace (for example an empty dict) is accepted while remaining valid Jinja. Because sanitize_jinja() is the sole guard on several launch-time fields — ad-hoc command module_args, Machine-credential username / become_method / become_user, and inventory host names — a low-privileged user can inject Jinja that ansible-core evaluates in the execution environment. This enables execution of arbitrary commands in the execution environment (bypassing an administrator's AD_HOC_COMMANDS module allowlist) and disclosure of secrets belonging to credentials the attacker cannot read (by templating a co-attached credential's injected environment variables), across the credential access-control boundary.
Weakness: CWE-184
Which versions are affected by CVE-2026-84714?
How do I fix CVE-2026-84714?
Apply the vendor's patch.
Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.
Is CVE-2026-84714 being exploited?
There is no known exploitation of CVE-2026-84714 in the wild and no public exploit code.
Sources
Also known as GHSA-8ghh-482v-94qp.