Cpe:2.3:a:redhat:ansible_automation_controller:*:*:*:*:*:*:*:* - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/cpes/cpe2.3aredhatansible_automation_controller/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioWed, 23 Sep 2026 20:44:45 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgJinja Injection Vulnerability in Ansible Automation Controllerhttps://feed.craftedsignal.io/briefs/2026-09-ansible-jinja-injection/Wed, 23 Sep 2026 20:44:45 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-09-ansible-jinja-injection/A flaw in the sanitize_jinja() function of Ansible Automation Controller allows low-privileged users to execute arbitrary commands and disclose sensitive credentials via injected Jinja templates.CVE-2026-84714 describes a critical input-validation vulnerability in the sanitize_jinja() function within Ansible Automation Controller. The function utilizes regular expressions to filter user-supplied Jinja code but fails to account for nested expressions, as the patterns terminate at the first encountered '}' or '%' character. Consequently, attackers can bypass these filters using nested Jinja syntax, such as empty dictionaries, which remain executable by ansible-core within the execution environment. This flaw affects multiple critical launch-time fields, including ad-hoc command module arguments, machine credential parameters (username, become_method, become_user), and inventory host names. A low-privileged user can leverage this vulnerability to bypass administrative module allowlists for ad-hoc commands, execute arbitrary code within the execution environment, and exfiltrate secrets from co-attached credentials by templating environment variables. The vulnerability allows for an escalation of privilege across defined credential access-control boundaries.

Impact

Successful exploitation allows low-privileged users to achieve arbitrary command execution within the Ansible execution environment and gain unauthorized access to sensitive credentials. This poses a significant risk to organizations relying on Ansible Automation Controller for secure infrastructure orchestration, as it permits attackers to bypass established security policies, such as ad-hoc command module allowlists, and exfiltrate credentials they would not normally be authorized to access.

Recommendation

  1. Monitor for and apply vendor-supplied patches for Ansible Automation Controller to address CVE-2026-84714.
  2. Review and audit existing Jinja templates used in inventory host names and credential parameters for unauthorized nested expressions.
  3. Restrict permissions for users authorized to define ad-hoc command parameters or inventory settings within the Automation Controller interface.
  4. Implement strict monitoring on the execution environment to detect unexpected command patterns or unauthorized access to credential-related environment variables.
]]>highadvisoryvulnerabilityjinja-injectionansible