# CVE-2026-84714: Code injection in Red Hat Ansible Automation Platform 2.5 for RHEL 8

> Low-privileged users can inject Jinja templates to execute arbitrary commands and read secrets in the Ansible execution environment.

- **Severity:** High 7.1 (`CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N`)
- **Exploited in the wild:** Not known
- **Login needed:** Any signed-in user
- **Attackable:** Over the internet
- **Victim action needed:** Not needed
- **Fix available:** Yes
- **Published:** 23 Sep 2026
- **Updated:** 16 Oct 2026
- **Also known as:** GHSA-8ghh-482v-94qp

## What is CVE-2026-84714?

CVE-2026-84714 is a high-severity code injection vulnerability in Red Hat Ansible Automation Platform 2.5 for RHEL 8, published on 23 Sep 2026. Any signed-in user can exploit it over the network, with no action from the victim.

### Official description

A flaw was found in the automation-controller input-validation
                  guard sanitize_jinja(). The function uses two regular
                  expressions to reject user-supplied Jinja, but the patterns
                  stop at the first interior '}' or '%' character, so a Jinja
                  expression containing an inner brace (for example an empty
                  dict) is accepted while remaining valid Jinja. Because
                  sanitize_jinja() is the sole guard on several launch-time
                  fields — ad-hoc command module_args, Machine-credential
                  username / become_method / become_user, and inventory host
                  names — a low-privileged user can inject Jinja that ansible-core
                  evaluates in the execution environment. This enables execution
                  of arbitrary commands in the execution environment (bypassing an
                  administrator's AD_HOC_COMMANDS module allowlist) and disclosure
                  of secrets belonging to credentials the attacker cannot read
                  (by templating a co-attached credential's injected environment
                  variables), across the credential access-control boundary.

Weakness: CWE-184 (Incomplete List of Disallowed Inputs)

## Which versions are affected by CVE-2026-84714?


## How do I fix CVE-2026-84714?

Apply the vendor's patch.

## Is CVE-2026-84714 being exploited?

There is no known exploitation of CVE-2026-84714 in the wild and no public exploit code.

## Fix prompt for AI coding agents

```text
Check this codebase for CVE-2026-84714 and fix it if it is affected.

What it is: CVE-2026-84714 is a high-severity code injection vulnerability in Red Hat Ansible Automation Platform 2.5 for RHEL 8, published on 23 Sep 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Exploitation: There is no known exploitation of CVE-2026-84714 in the wild and no public exploit code.

Affected product: Red Hat Ansible Automation Platform 2.5 for RHEL 8. No package-level version data is available, so check the vendor advisory linked from the reference page.

Task:
1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.
2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.
3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.
4. Run the tests and summarise what changed and why.
5. If nothing in the project is affected, say so and change nothing.

Reference: https://insights.sbomify.com/CVE-2026-84714/ (Markdown: https://insights.sbomify.com/CVE-2026-84714/index.md)
```

## Sources

- CVE record: https://www.cve.org/CVERecord?id=CVE-2026-84714
- NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-84714
- OSV: https://osv.dev/vulnerability/CVE-2026-84714

---
From sbomify Insights: https://insights.sbomify.com/CVE-2026-84714/
Summaries are generated and may contain mistakes; the official description above is the record.