CVE-2026-84502

Name of the Vulnerable Software and Affected Versions Red Hat Ansible Automation Platform automation-controller (affected versions not specified)

Description An argument-injection flaw exists in the automation-controller where the Project scm url field is not validated against values starting with a dash. This value is passed verbatim to the git SCM module, which executes git ls-remote without a -- separator. Consequently, a crafted URL starting with --upload-pack can be interpreted as an option rather than a repository URL, allowing an authenticated user with permissions to create or modify a project within a single organization to execute arbitrary commands on the control-plane task pod. The output of these commands is reflected through the project update stdout endpoint, potentially leading to cross-tenant compromise and lateral movement within the cluster.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.