CVE-2026-85475 Automation-controller: automation-controller-container: automation-controller: rsyslog configuration injection via log_aggregator_* settings leads to remote code execution in the control-plane rsyslog component
Description
A flaw was found in the Ansible Automation Platform automation controller. The external logging (rsyslog) configuration is generated by interpolating user-controlled settings — LOG_AGGREGATOR_HOST, LOG_AGGREGATOR_MAX_DISK_USAGE_PATH and LOG_AGGREGATOR_RSYSLOGD_ERROR_LOG_FILE — into an rsyslog RainerScript config file without neutralizing RainerScript syntax. A privileged (superuser) user can inject rsyslog directives, including an omprog action, causing arbitrary command execution inside the control-plane rsyslog component. This allows disclosure of the controller SECRET_KEY and database credentials, decryption of all stored credentials, and full compromise of the control plane.
CVSS 3.1 detail
Vector CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:HExploitable remotely over the network, with an administrator account and without any user action; an attacker can seriously compromise confidentiality, integrity or availability.
- Attack vector
- Network
- Attack complexity
- Low
- Privileges required
- High
- Interaction
- None
- Scope
- Unchanged
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| Red Hat Ansible Automation Platform 2 | Versions not published | |
| Red Hat Ansible Automation Platform 2.7 1789580684 | earliest → < 1789580684 | 1789580684 |
References
- RHSA-2026:71177 access.redhat.com
- access.redhat.com access.redhat.com
- RHBZ#2528255 bugzilla.redhat.com
Timeline
- Published
- Last modified