CVE-2026-84724: Ansible Automation Platform RCE Vulnerability

CVE-2026-84724 Overview

CVE-2026-84724 is an argument-injection flaw in the Red Hat Ansible Automation Platform automation-controller system-job subsystem [CWE-88]. The system-job template launch endpoint stores a user-supplied days variable without applying the integer validation defined elsewhere for that field. The dispatcher then flattens the management-command argument list into a single space-separated string before the job runner re-splits it, allowing embedded spaces to become additional command-line arguments. Because system jobs execute in-process on the control node without the container isolation applied to other job types, an authenticated superuser can inject arguments into the awx-manage process.

Critical Impact
An authenticated superuser can control the argument vector and the first entry of the Python module search path for the control-plane awx-manage process. Full remote code execution requires an import gadget not present in current management commands.

Affected Products

Red Hat Ansible Automation Platform (automation-controller component)
Red Hat Ansible Automation Platform 2.4
Red Hat Ansible Automation Platform 2.5

Discovery Timeline

2026-09-23 - CVE-2026-84724 published to NVD
2026-09-24 - Last updated in NVD database

Technical Details for CVE-2026-84724

Vulnerability Analysis

The flaw resides in how the system-job template launch endpoint handles the days parameter passed to management commands such as cleanup jobs. Integer validation exists for the field in other code paths but is not enforced at the launch endpoint. The stored value therefore accepts arbitrary strings, including whitespace characters.

During dispatch, the management-command argument list is flattened into a single string joined by spaces. The job runner subsequently re-splits that string on whitespace. Any spaces embedded in the days value are promoted to independent command-line arguments passed to awx-manage.

System jobs run in-process on the control node. Unlike other job types, they do not benefit from the container isolation Ansible Automation Platform applies to user-executed workloads. Injected arguments therefore influence the control-plane Python interpreter directly.

Root Cause

Two defects compound to produce the vulnerability. First, missing input validation on the days field permits non-integer values through the launch endpoint. Second, an unsafe join-then-split serialization of the argument list treats the concatenated string as tokenized input, violating the invariant that a single logical argument remains a single argument. This is a classic argument-injection pattern tracked as [CWE-88].

Attack Vector

An authenticated user holding superuser privileges submits a crafted days value containing spaces and additional flags to the system-job launch endpoint. Because the interpreter invoked is Python, an attacker can inject Python interpreter options such as -I or the module search path override, controlling sys.path[0] for the awx-manage process. The demonstrated impact is argument injection with control of the process search path. Reaching arbitrary code execution requires an additional import gadget in the invoked management command; no such gadget is currently present. See the Red Hat CVE Analysis for CVE-2026-84724 for the vendor's technical assessment.

Detection Methods for CVE-2026-84724

Indicators of Compromise

Launches of system-job templates by superuser accounts with unusual extra_vars values, particularly days fields containing whitespace, hyphens, or Python interpreter flags.
awx-manage process invocations on the control node whose argument vector includes unexpected flags such as -I, -S, or path-manipulation options.
Job records in the automation-controller database where the stored days variable is not a valid integer.

Detection Strategies

Audit automation-controller API access logs for POST requests to system-job launch endpoints and inspect the extra_vars payload for non-numeric days values.
Correlate control-node process telemetry with automation-controller job launches to identify awx-manage invocations with argument vectors that deviate from expected management-command patterns.
Alert on superuser account activity that launches system jobs outside scheduled maintenance windows.

Monitoring Recommendations

Ingest automation-controller audit logs and control-node process execution telemetry into a centralized analytics platform for cross-source correlation.
Baseline the normal argument patterns for awx-manage on control nodes and alert on deviations.
Track creation, modification, and elevation of superuser accounts in Ansible Automation Platform, since exploitation requires that privilege level.

How to Mitigate CVE-2026-84724

Immediate Actions Required

Apply the Red Hat security updates referenced in RHSA-2026:71113, RHSA-2026:71114, RHSA-2026:71177, and RHSA-2026:71179 to affected automation-controller deployments.
Review and reduce the number of accounts holding superuser privileges in Ansible Automation Platform.
Rotate credentials for any superuser account that may have been exposed or shared.

Patch Information

Red Hat has published fixes through the errata listed in the Red Hat Bug Report #2527222 and the corresponding RHSA advisories. Administrators should consult the Red Hat CVE Analysis for CVE-2026-84724 to map their installed automation-controller version to the appropriate patched release before scheduling maintenance.

Workarounds

Restrict superuser role assignment to a minimal set of accounts protected by strong authentication and monitoring.
Disable or restrict use of system-job templates until the patch is applied where operationally feasible.
Enforce role-based access control (RBAC) policies that prevent lower-privileged users from being escalated to superuser during the exposure window.

bash

# Configuration example: list current superusers via awx-manage to inventory exposure
awx-manage list_superusers