{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/products/ansible-automation-controller/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:redhat:ansible_automation_controller:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":7.1,"id":"CVE-2026-84714"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["Ansible Automation Controller"],"_cs_severities":["high"],"_cs_tags":["vulnerability","jinja-injection","ansible"],"_cs_type":"advisory","_cs_vendors":["Red Hat"],"content_html":"\u003cp\u003eCVE-2026-84714 describes a critical input-validation vulnerability in the sanitize_jinja() function within Ansible Automation Controller. The function utilizes regular expressions to filter user-supplied Jinja code but fails to account for nested expressions, as the patterns terminate at the first encountered '}' or '%' character. Consequently, attackers can bypass these filters using nested Jinja syntax, such as empty dictionaries, which remain executable by ansible-core within the execution environment. This flaw affects multiple critical launch-time fields, including ad-hoc command module arguments, machine credential parameters (username, become_method, become_user), and inventory host names. A low-privileged user can leverage this vulnerability to bypass administrative module allowlists for ad-hoc commands, execute arbitrary code within the execution environment, and exfiltrate secrets from co-attached credentials by templating environment variables. The vulnerability allows for an escalation of privilege across defined credential access-control boundaries.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation allows low-privileged users to achieve arbitrary command execution within the Ansible execution environment and gain unauthorized access to sensitive credentials. This poses a significant risk to organizations relying on Ansible Automation Controller for secure infrastructure orchestration, as it permits attackers to bypass established security policies, such as ad-hoc command module allowlists, and exfiltrate credentials they would not normally be authorized to access.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eMonitor for and apply vendor-supplied patches for Ansible Automation Controller to address CVE-2026-84714.\u003c/li\u003e\n\u003cli\u003eReview and audit existing Jinja templates used in inventory host names and credential parameters for unauthorized nested expressions.\u003c/li\u003e\n\u003cli\u003eRestrict permissions for users authorized to define ad-hoc command parameters or inventory settings within the Automation Controller interface.\u003c/li\u003e\n\u003cli\u003eImplement strict monitoring on the execution environment to detect unexpected command patterns or unauthorized access to credential-related environment variables.\u003c/li\u003e\n\u003c/ol\u003e\n","date_modified":"2026-09-23T20:44:45Z","date_published":"2026-09-23T20:44:45Z","id":"https://feed.craftedsignal.io/briefs/2026-09-ansible-jinja-injection/","summary":"A flaw in the sanitize_jinja() function of Ansible Automation Controller allows low-privileged users to execute arbitrary commands and disclose sensitive credentials via injected Jinja templates.","title":"Jinja Injection Vulnerability in Ansible Automation Controller","url":"https://feed.craftedsignal.io/briefs/2026-09-ansible-jinja-injection/"}],"language":"en","title":"CraftedSignal Threat Feed - Ansible Automation Controller","version":"https://jsonfeed.org/version/1.1"}