Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
9.9
CVE-2026-84502: Red Hat Ansible Automation Platform lets attackers run commands via project URL
CVE-2026-84502 · published 18 days ago
Summary
If a user can create or edit a project, they can supply a specially crafted git URL that tricks the system into executing arbitrary commands on the controller's task pod. This can let an attacker run code, see the results, and move to other parts of the cluster. Update to the latest patched version of Red Hat Ansible Automation Platform or restrict project creation rights until the fix is applied.
What to do
The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.
Affected software
| Vendor | Product | Affected versions |
|---|---|---|
| red hat | red hat ansible automation platform 2.4 for rhel 8 | All versions |
| red hat | red hat ansible automation platform 2.4 for rhel 9 | All versions |
| red hat | red hat ansible automation platform 2 | All versions |
| red hat | red hat ansible automation platform 2.6 for rhel 9 | All versions |
| red hat | red hat ansible automation platform 2.5 for rhel 8 | All versions |
| red hat | red hat ansible automation platform 2.5 for rhel 9 | All versions |
| red hat | red hat ansible automation platform 2.6 | All versions |
| red hat | red hat ansible automation platform 2.7 | All versions |
Original advisory text
Automation-controller: automation-controller-container: automation-controller: project scm_url argument injection into `git ls-remote --upload-pack` yields rce on the controller-task control-plane pod
A flaw was found in Red Hat Ansible Automation Platform's automation-
controller. The Project scm_url field is not validated against values that
begin with a dash and is stored and passed verbatim to the git SCM module.
Because the module runs git ls-remote with the URL as a positional argument and
without a "--" separator, a git project URL such as "--upload-pack=<command>:x"
is interpreted by git as the --upload-pack option and executed via a shell. A
user with permission to create or modify a project in a single organization can
thereby execute arbitrary commands on the control-plane task pod, with output
reflected through the project update stdout endpoint, leading to cross-tenant
compromise and in-cluster lateral movement
controller. The Project scm_url field is not validated against values that
begin with a dash and is stored and passed verbatim to the git SCM module.
Because the module runs git ls-remote with the URL as a positional argument and
without a "--" separator, a git project URL such as "--upload-pack=<command>:x"
is interpreted by git as the --upload-pack option and executed via a shell. A
user with permission to create or modify a project in a single organization can
thereby execute arbitrary commands on the control-plane task pod, with output
reflected through the project update stdout endpoint, leading to cross-tenant
compromise and in-cluster lateral movement
References
- https://access.redhat.com/security/cve/CVE-2026-84502
- https://bugzilla.redhat.com/show_bug.cgi?id=2527096
- https://access.redhat.com/errata/RHSA-2026:71113
- https://access.redhat.com/errata/RHSA-2026:71115
- https://access.redhat.com/errata/RHSA-2026:71114
- https://access.redhat.com/errata/RHSA-2026:71177
- https://access.redhat.com/errata/RHSA-2026:71179
Internet-facing
14 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit
- Gives an attacker full control
Type
CWE-88Improper Neutralization of Argument Delimiters in a Command ('Argument Injection')
Timeline
Published23 Sep 2026
Updated11 Oct 2026
First seen23 Sep 2026
Track software like this
Free during beta