CVE-2026-85475 Red Hat CVE debrief

Who should care

System administrators and security teams responsible for Ansible Automation Platform deployments should assess exposure and prioritize remediation. They should review and restrict access to the automation controller's external logging configuration, verify and apply vendor-provided patches or updates, and monitor rsyslog configuration and logs for suspicious activity.

Why it matters

A privileged user can inject rsyslog directives, potentially leading to arbitrary command execution and disclosure of sensitive information in Ansible Automation Platform deployments.

• Potential arbitrary command execution inside the control-plane rsyslog component
• Disclosure of the controller SECRET_KEY and database credentials
• Decryption of all stored credentials
• Full compromise of the control plane

Technical summary

The Ansible Automation Platform automation controller's external logging configuration is generated by interpolating user-controlled settings into an rsyslog RainerScript config file without neutralizing RainerScript syntax. A privileged user can inject rsyslog directives, potentially leading to arbitrary command execution and disclosure of sensitive information. This allows disclosure of the controller SECRET_KEY and database credentials, decryption of all stored credentials, and full compromise of the control plane.

Defensive priority

High

Recommended defensive actions

• Review and restrict access to the automation controller's external logging configuration
• Verify and apply vendor-provided patches or updates
• Monitor rsyslog configuration and logs for suspicious activity
• Restrict use of superuser privileges
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

The CVE record and NVD entry provide details on the flaw, but the scope of affected versions and remediation steps require verification from official sources. Affected product deployments should be reviewed for exposure, and owners should prioritize remediation based on the provided vendor guidance. The external logging configuration should be reviewed and restricted to prevent exploitation.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.