CVE-2026-85475: Ansible Automation Platform RCE Vulnerability

CVE-2026-85475 Overview

A code injection flaw exists in the Red Hat Ansible Automation Platform automation controller. The external logging component generates its rsyslog RainerScript configuration by interpolating user-controlled settings without neutralizing RainerScript syntax. The affected settings are LOG_AGGREGATOR_HOST, LOG_AGGREGATOR_MAX_DISK_USAGE_PATH, and LOG_AGGREGATOR_RSYSLOGD_ERROR_LOG_FILE. A superuser can inject rsyslog directives, including an omprog action, to execute arbitrary commands inside the control-plane rsyslog process. Successful exploitation discloses the controller SECRET_KEY and database credentials, enabling decryption of all stored credentials and full compromise of the control plane. The weakness is classified under CWE-96: Improper Neutralization of Directives in Statically Saved Code.

Critical Impact
Superuser-level RainerScript injection yields arbitrary command execution as the rsyslog service, exposing the controller SECRET_KEY, database credentials, and every stored credential.

Affected Products

Red Hat Ansible Automation Platform
Automation Controller (control-plane rsyslog component)
Deployments using external logging (LOG_AGGREGATOR_* settings)

Discovery Timeline

2026-09-23 - CVE-2026-85475 published to NVD
2026-09-24 - Last updated in NVD database

Technical Details for CVE-2026-85475

Vulnerability Analysis

The automation controller builds an rsyslog configuration file dynamically from platform settings. Three settings, LOG_AGGREGATOR_HOST, LOG_AGGREGATOR_MAX_DISK_USAGE_PATH, and LOG_AGGREGATOR_RSYSLOGD_ERROR_LOG_FILE, are inserted into a RainerScript template as raw strings. RainerScript control characters, quotes, and action blocks are not escaped or validated.

An authenticated superuser can therefore place additional RainerScript directives inside any of these fields. When the controller regenerates its logging configuration and rsyslog reloads, the injected directives are parsed as first-class configuration. The omprog output module is particularly dangerous because it launches an external program and pipes log messages to it, providing a direct path to arbitrary command execution.

Because the rsyslog component runs inside the control plane with access to controller secrets, the attacker can read the SECRET_KEY used to encrypt stored credentials and the database connection settings. This turns a privileged application-level foothold into full control-plane compromise.

Root Cause

The root cause is unsafe string interpolation of user-controllable settings into a RainerScript configuration. There is no sanitization layer between the settings API and the generated rsyslog.conf, so RainerScript syntax supplied by a superuser is treated as trusted configuration.

Attack Vector

Exploitation requires network access to the controller API and superuser privileges. The attacker modifies one of the vulnerable LOG_AGGREGATOR_* settings to include malicious RainerScript, triggers a logging configuration reload, and receives command execution when rsyslog processes the next matching log event. No user interaction is required. Verified public exploit code is not available; refer to the Red Hat CVE page for authoritative technical details.

Detection Methods for CVE-2026-85475

Indicators of Compromise

Unexpected changes to LOG_AGGREGATOR_HOST, LOG_AGGREGATOR_MAX_DISK_USAGE_PATH, or LOG_AGGREGATOR_RSYSLOGD_ERROR_LOG_FILE in the controller settings audit log.
Presence of RainerScript action keywords such as omprog, action(, or module( inside the generated rsyslog.conf on control-plane hosts.
Child processes spawned by the rsyslog daemon that are not part of a standard deployment, especially shells or interpreters.
Outbound network connections from the rsyslog process to unfamiliar destinations shortly after a settings change.

Detection Strategies

Alert on API calls to the controller settings endpoint that modify any LOG_AGGREGATOR_* field, correlating on superuser identity.
Diff the deployed rsyslog configuration against a known-good baseline and flag any newly introduced action or module directives.
Monitor process ancestry on control-plane nodes for rsyslogd spawning executables outside an allowlist.

Monitoring Recommendations

Ship controller audit logs and rsyslog process telemetry to a centralized platform for correlation across hosts.
Track superuser session activity, including token issuance and settings mutations, with alerting on off-hours changes.
Watch for reads of the controller SECRET_KEY file and database credential files by processes other than the controller service.

How to Mitigate CVE-2026-85475

Immediate Actions Required

Apply the update referenced in Red Hat Security Advisory RHSA-2026:71177 to all automation controller instances.
Rotate the controller SECRET_KEY, database credentials, and any credentials stored in the controller after patching.
Review the controller audit log for prior modifications to LOG_AGGREGATOR_* settings and inspect the generated rsyslog configuration for injected directives.
Restrict superuser accounts and enforce multi-factor authentication for administrative access to the controller.

Patch Information

Red Hat has released fixed packages through RHSA-2026:71177. Additional context is available in the Red Hat CVE record and Bugzilla #2528255. Apply the vendor-supplied update rather than attempting an in-place source patch.

Workarounds

Disable external logging by clearing LOG_AGGREGATOR_HOST until patched packages are deployed.
Limit the set of accounts holding the superuser role and audit existing assignments.
Add change-control review for any modification of LOG_AGGREGATOR_* settings, requiring peer approval before the settings API call is executed.

bash

# Configuration example
# Verify current LOG_AGGREGATOR_* values via the controller API
curl -sS -H "Authorization: Bearer $TOKEN" \
  https://controller.example.com/api/v2/settings/logging/ \
  | jq '{LOG_AGGREGATOR_HOST, LOG_AGGREGATOR_MAX_DISK_USAGE_PATH, LOG_AGGREGATOR_RSYSLOGD_ERROR_LOG_FILE}'

# Inspect the generated rsyslog config for injected directives
sudo grep -E 'omprog|action\(|module\(' /etc/rsyslog.d/*.conf /etc/rsyslog.conf