Description
A flaw was found in the Ansible Automation Platform automation controller. The
external logging (rsyslog) configuration is generated by interpolating
user-controlled settings — LOG_AGGREGATOR_HOST, LOG_AGGREGATOR_MAX_DISK_USAGE_PATH
and LOG_AGGREGATOR_RSYSLOGD_ERROR_LOG_FILE — into an rsyslog RainerScript config
file without neutralizing RainerScript syntax. A privileged (superuser) user can
inject rsyslog directives, including an omprog action, causing arbitrary command
execution inside the control-plane rsyslog component. This allows disclosure of
the controller SECRET_KEY and database credentials, decryption of all stored
credentials, and full compromise of the control plane.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Red Hat | Red Hat Ansible Automation Platform 2.7 | — | — |
| Red Hat | Red Hat Ansible Automation Platform 2 | — | — |
Advisories 1
- WID-SEC-2026-3555 Red Hat Ansible Automation Platform (automation-controller): Mehrere Schwachstellen BSI CERT-Bund (WID) · Nov 12, 2026
References
- RHSA-2026:71177 vendor-advisory
- https://access.redhat.com/security/cve/CVE-2026-85475 vdb-entry
- RHBZ#2528255 issue-tracking