Skip to content
CVE PROGRAM SOURCE RECORD9.9 Critical

CVE-2026-84502

Automation-controller: automation-controller-container: automation-controller: project scm_url argument injection into `git ls-remote --upload-pack` yields rce on the controller-task control-plane pod

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
redhat

Description

A flaw was found in Red Hat Ansible Automation Platform's automation- controller. The Project scm_url field is not validated against values that begin with a dash and is stored and passed verbatim to the git SCM module. Because the module runs git ls-remote with the URL as a positional argument and without a "--" separator, a git project URL such as "--upload-pack=<command>:x" is interpreted by git as the --upload-pack option and executed via a shell. A user with permission to create or modify a project in a single organization can thereby execute arbitrary commands on the control-plane task pod, with output reflected through the project update stdout endpoint, leading to cross-tenant compromise and in-cluster lateral movement

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Red Hat Red Hat Ansible Automation Platform 2.4 for RHEL 8

Default version status: affected

  • 0:4.5.36-1.el8ap to < *unaffected

Red Hat Red Hat Ansible Automation Platform 2.4 for RHEL 9

Default version status: affected

  • 0:4.5.36-1.el9ap to < *unaffected

Red Hat Red Hat Ansible Automation Platform 2.5 for RHEL 8

Default version status: affected

  • 0:4.6.33-1.el8ap to < *unaffected

Red Hat Red Hat Ansible Automation Platform 2.5 for RHEL 9

Default version status: affected

  • 0:4.6.33-1.el9ap to < *unaffected

Red Hat Red Hat Ansible Automation Platform 2.6 for RHEL 9

Default version status: affected

  • 0:4.7.17-1.el9ap to < *unaffected

Red Hat Red Hat Ansible Automation Platform 2.6

Default version status: affected

  • 1789673739 to < *unaffected

Red Hat Red Hat Ansible Automation Platform 2.7

Default version status: affected

  • 1789580684 to < *unaffected

References