Jinja Injection Vulnerability in Ansible Automation Controller

CVE-2026-84714 describes a critical input-validation vulnerability in the sanitize_jinja() function within Ansible Automation Controller. The function utilizes regular expressions to filter user-supplied Jinja code but fails to account for nested expressions, as the patterns terminate at the first encountered '}' or '%' character. Consequently, attackers can bypass these filters using nested Jinja syntax, such as empty dictionaries, which remain executable by ansible-core within the execution environment. This flaw affects multiple critical launch-time fields, including ad-hoc command module arguments, machine credential parameters (username, become_method, become_user), and inventory host names. A low-privileged user can leverage this vulnerability to bypass administrative module allowlists for ad-hoc commands, execute arbitrary code within the execution environment, and exfiltrate secrets from co-attached credentials by templating environment variables. The vulnerability allows for an escalation of privilege across defined credential access-control boundaries.

Impact

Successful exploitation allows low-privileged users to achieve arbitrary command execution within the Ansible execution environment and gain unauthorized access to sensitive credentials. This poses a significant risk to organizations relying on Ansible Automation Controller for secure infrastructure orchestration, as it permits attackers to bypass established security policies, such as ad-hoc command module allowlists, and exfiltrate credentials they would not normally be authorized to access.

Recommendation

1. Monitor for and apply vendor-supplied patches for Ansible Automation Controller to address CVE-2026-84714.
2. Review and audit existing Jinja templates used in inventory host names and credential parameters for unauthorized nested expressions.
3. Restrict permissions for users authorized to define ad-hoc command parameters or inventory settings within the Automation Controller interface.
4. Implement strict monitoring on the execution environment to detect unexpected command patterns or unauthorized access to credential-related environment variables.