Skip to content
OpenAdvisories
High · 7.2 CVE-2026-85475 EUVD-2026-85607GHSA-wpwh-486h-5v3j

Automation-controller: automation-controller-container: automation-controller: rsyslog configuration injection via log_aggregator_* settings leads to remote code execution in the control-plane rsyslog component

Published Sep 23, 2026 · Updated Nov 4, 2026 · Assigned by redhat

Description

A flaw was found in the Ansible Automation Platform automation controller. The
external logging (rsyslog) configuration is generated by interpolating
user-controlled settings — LOG_AGGREGATOR_HOST, LOG_AGGREGATOR_MAX_DISK_USAGE_PATH
and LOG_AGGREGATOR_RSYSLOGD_ERROR_LOG_FILE — into an rsyslog RainerScript config
file without neutralizing RainerScript syntax. A privileged (superuser) user can
inject rsyslog directives, including an omprog action, causing arbitrary command
execution inside the control-plane rsyslog component. This allows disclosure of
the controller SECRET_KEY and database credentials, decryption of all stored
credentials, and full compromise of the control plane.

Affected products

VendorProductAffectedFixed
Red Hat Red Hat Ansible Automation Platform 2.7 — —
Red Hat Red Hat Ansible Automation Platform 2 — —

Advisories 1

References