A flaw was found in the automation-controller input-validation guard sanitize_jinja().
High7.1CVE-2026-84714 · Published Sep 23, 2026 · updated Sep 24, 2026
Affected versions
| Package | Affected | Fixed in |
|---|
Details and references
A flaw was found in the automation-controller input-validation guard sanitize_jinja(). The function uses two regular expressions to reject user-supplied Jinja, but the patterns stop at the first interior '}' or '%' character, so a Jinja expression containing an inner brace (for example an empty dict) is accepted while remaining valid Jinja. Because sanitize_jinja() is the sole guard on several launch-time fields — ad-hoc command module_args, Machine-credential username / become_method / become_user, and inventory host names — a low-privileged user can inject Jinja that ansible-core evaluates in the execution environment. This enables execution of arbitrary commands in the execution environment (bypassing an administrator's AD_HOC_COMMANDS module allowlist) and disclosure of secrets belonging to credentials the attacker cannot read (by templating a co-attached credential's injected environment variables), across the credential access-control boundary.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N
- Severity from
- no source yet
- Weakness
- CWE-184
- www.cve.org/CVERecord?id=CVE-2026-84714
- nvd.nist.gov/vuln/detail/CVE-2026-84714
- access.redhat.com/errata/RHSA-2026:71113
- access.redhat.com/errata/RHSA-2026:71114
- access.redhat.com/errata/RHSA-2026:71177
- access.redhat.com/errata/RHSA-2026:71179
- access.redhat.com/security/cve/CVE-2026-84714
- bugzilla.redhat.com/show_bug.cgi?id=2527198