redhat ansible-automation-platform CVE-2026-84502 is a vulnerability in Red Hat Ansible Automation Platform
Published on September 23, 2026

Automation-controller: automation-controller-container: automation-controller: project scm_url argument injection into `git ls-remote --upload-pack` yields rce on the controller-task control-plane pod
A flaw was found in Red Hat Ansible Automation Platform's automation- controller. The Project scm_url field is not validated against values that begin with a dash and is stored and passed verbatim to the git SCM module. Because the module runs git ls-remote with the URL as a positional argument and without a "--" separator, a git project URL such as "--upload-pack=<command>:x" is interpreted by git as the --upload-pack option and executed via a shell. A user with permission to create or modify a project in a single organization can thereby execute arbitrary commands on the control-plane task pod, with output reflected through the project update stdout endpoint, leading to cross-tenant compromise and in-cluster lateral movement

Vendor Advisory NVD

Vulnerability Analysis

CVE-2026-84502 is exploitable with network access, and requires small amount of user privileges. This vulnerability is considered to have a low attack complexity. The potential impact of an exploit of this vulnerability is considered to be critical as this vulnerability has a high impact to the confidentiality, integrity and availability of this component.

Attack Vector:
NETWORK
Attack Complexity:
LOW
Privileges Required:
LOW
User Interaction:
NONE
Scope:
CHANGED
Confidentiality Impact:
HIGH
Integrity Impact:
HIGH
Availability Impact:
HIGH

Timeline

Reported to Red Hat.

Made public. 22 days later.

Weakness Type

What is an Argument Injection Vulnerability?

The software constructs a string for a command to executed by a separate component in another control sphere, but it does not properly delimit the intended arguments, options, or switches within that command string.

CVE-2026-84502 has been classified to as an Argument Injection vulnerability or weakness.


Products Associated with CVE-2026-84502

Want to know whenever a new CVE is published for Red Hat Ansible Automation Platform? stack.watch will email you.

Red Hat Ansible Automation Platform
 

Affected Versions

Red Hat Ansible Automation Platform 2.4 for RHEL 8: Red Hat Ansible Automation Platform 2.4 for RHEL 9: Red Hat Ansible Automation Platform 2: Red Hat Ansible Automation Platform 2: