CVE-2026-84706

Name of the Vulnerable Software and Affected Versions Ansible Automation Platform automation-controller (affected versions not specified)

Description A flaw exists in the custom Credential Type environment-variable injector. The system validates variable names using a deny-list consisting of an ANSIBLE * prefix check and a fixed ENV BLOCKLIST, but it fails to include process-hijacking loader variables such as BASH ENV, ENV, LD PRELOAD, LD LIBRARY PATH, PYTHONSTARTUP, and GIT SSH COMMAND. A privileged user can exploit this by using the credential file injector to write a malicious script into the execution environment and directing BASH ENV to that script, resulting in arbitrary code execution within the execution-environment container for any job utilizing a credential of that type.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.