CVE-2026-84724 Command injection in Red Hat Ansible Automation Platform 2.5 for RHEL 8
Authenticated superusers can inject arguments into the control-plane process via system jobs, potentially leading to code execution or privilege escalation.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-84724?
CVE-2026-84724 is a medium-severity command injection vulnerability in Red Hat Ansible Automation Platform 2.5 for RHEL 8, published on 23 Sep 2026. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
An argument-injection flaw was found in the Ansible Automation Platform automation-controller system-job subsystem. The system-job template launch endpoint stores a user-supplied "days" variable without running the integer validation defined elsewhere for that field, and the dispatcher flattens the management-command argument list into a single string with spaces before the job runner re-splits it, so spaces in the value become additional command-line arguments. Because system jobs are executed in-process on the control node without the container isolation applied to all other job types, an authenticated user with superuser privileges can inject arbitrary arguments — including Python's path option — into the control-plane awx-manage process, controlling its argument vector and the first entry of its module search path. Full remote code execution requires an additional import gadget that is not present in the current management commands, so the demonstrated impact is argument injection with control of the process search path rather than confirmed code execution.
Weakness: CWE-88
Which versions are affected by CVE-2026-84724?
How do I fix CVE-2026-84724?
Apply the vendor's patch.
Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.
Is CVE-2026-84724 being exploited?
There is no known exploitation of CVE-2026-84724 in the wild and no public exploit code.
Sources
Also known as GHSA-q3jc-p8r9-qrvp.