CVE-2026-84714 Red Hat CVE debrief

Who should care

Defenders responsible for automation-controller deployments, especially those with low-privileged user access, should assess exposure and verify the effectiveness of current input validation and sanitization measures.

Why it matters

CVE-2026-84714 allows low-privileged users to inject malicious Jinja, potentially leading to arbitrary command execution and secret disclosure in automation-controller deployments.

• Potential execution of arbitrary commands in the execution environment
• Possible disclosure of secrets belonging to credentials
• Bypassing of administrator's AD_HOC_COMMANDS module allowlist
• Verification of input validation and sanitization measures

Technical summary

The automation-controller input-validation guard sanitize_jinja() uses incomplete regular expressions, allowing low-privileged users to inject Jinja that ansible-core evaluates in the execution environment. This enables execution of arbitrary commands and disclosure of secrets belonging to credentials. The vulnerability affects ad-hoc module_args, machine-credential fields, and host names, potentially leading to unauthorized access and data breaches. Defenders should prioritize verifying exposure in automation-controller deployments, especially where low-privileged users have access, and assess the effectiveness of current input validation and sanitization measures.

Defensive priority

Defenders should prioritize verifying exposure in automation-controller deployments, especially where low-privileged users have access, and assess the effectiveness of current input validation and sanitization measures.

Recommended defensive actions

• Verify and update automation-controller to the latest version
• Restrict access to low-privileged users
• Implement additional input validation and sanitization measures
• Review compensating controls for exposed systems
• Check relevant monitoring, detection, and logs for exposed assets
• Track exceptions and retest remediated assets
• Plan vendor-supported updates or mitigations through normal change control

Evidence notes

The CVE record and source item provide details on the vulnerability in automation-controller, including the incomplete sanitize_jinja() regex and potential impacts on ad-hoc module_args, machine-credential fields, and host names.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.