{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2026-84502","assignerOrgId":"53f830b8-0a3f-465b-8143-3b8a9948e749","state":"PUBLISHED","assignerShortName":"redhat","dateReserved":"2026-09-01T21:00:38.911Z","datePublished":"2026-09-23T18:47:26.089Z","dateUpdated":"2026-09-24T05:58:21.514Z"},"containers":{"cna":{"title":"Automation-controller: automation-controller-container: automation-controller: project scm_url argument injection into `git ls-remote --upload-pack` yields rce on the controller-task control-plane pod","metrics":[{"other":{"content":{"value":"Critical","namespace":"https://access.redhat.com/security/updates/classification/"},"type":"Red Hat severity rating"}},{"cvssV3_1":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":9.9,"baseSeverity":"CRITICAL","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"CHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","version":"3.1"},"format":"CVSS"}],"descriptions":[{"lang":"en","value":"A flaw was found in Red Hat Ansible Automation Platform's automation-\ncontroller. The Project scm_url field is not validated against values that\nbegin with a dash and is stored and passed verbatim to the git SCM module.\nBecause the module runs git ls-remote with the URL as a positional argument and\nwithout a \"--\" separator, a git project URL such as \"--upload-pack=<command>:x\"\nis interpreted by git as the --upload-pack option and executed via a shell. A\nuser with permission to create or modify a project in a single organization can\nthereby execute arbitrary commands on the control-plane task pod, with output\nreflected through the project update stdout endpoint, leading to cross-tenant\ncompromise and in-cluster lateral movement"}],"affected":[{"vendor":"Red Hat","product":"Red Hat Ansible Automation Platform 2.4 for RHEL 8","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","packageName":"automation-controller","defaultStatus":"affected","versions":[{"version":"0:4.5.36-1.el8ap","lessThan":"*","versionType":"rpm","status":"unaffected"}],"cpes":["cpe:/a:redhat:ansible_automation_platform:2.4::el8","cpe:/a:redhat:ansible_automation_platform:2.4::el9","cpe:/a:redhat:ansible_automation_platform_developer:2.4::el8","cpe:/a:redhat:ansible_automation_platform_developer:2.4::el9"]},{"vendor":"Red Hat","product":"Red Hat Ansible Automation Platform 2.4 for RHEL 9","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","packageName":"automation-controller","defaultStatus":"affected","versions":[{"version":"0:4.5.36-1.el9ap","lessThan":"*","versionType":"rpm","status":"unaffected"}],"cpes":["cpe:/a:redhat:ansible_automation_platform:2.4::el8","cpe:/a:redhat:ansible_automation_platform:2.4::el9","cpe:/a:redhat:ansible_automation_platform_developer:2.4::el8","cpe:/a:redhat:ansible_automation_platform_developer:2.4::el9"]},{"vendor":"Red Hat","product":"Red Hat Ansible Automation Platform 2.5 for RHEL 8","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","packageName":"automation-controller","defaultStatus":"affected","versions":[{"version":"0:4.6.33-1.el8ap","lessThan":"*","versionType":"rpm","status":"unaffected"}],"cpes":["cpe:/a:redhat:ansible_automation_platform:2.5::el8","cpe:/a:redhat:ansible_automation_platform:2.5::el9","cpe:/a:redhat:ansible_automation_platform_developer:2.5::el8","cpe:/a:redhat:ansible_automation_platform_developer:2.5::el9","cpe:/a:redhat:ansible_automation_platform_inside:2.5::el8","cpe:/a:redhat:ansible_automation_platform_inside:2.5::el9"]},{"vendor":"Red Hat","product":"Red Hat Ansible Automation Platform 2.5 for RHEL 9","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","packageName":"automation-controller","defaultStatus":"affected","versions":[{"version":"0:4.6.33-1.el9ap","lessThan":"*","versionType":"rpm","status":"unaffected"}],"cpes":["cpe:/a:redhat:ansible_automation_platform:2.5::el8","cpe:/a:redhat:ansible_automation_platform:2.5::el9","cpe:/a:redhat:ansible_automation_platform_developer:2.5::el8","cpe:/a:redhat:ansible_automation_platform_developer:2.5::el9","cpe:/a:redhat:ansible_automation_platform_inside:2.5::el8","cpe:/a:redhat:ansible_automation_platform_inside:2.5::el9"]},{"vendor":"Red Hat","product":"Red Hat Ansible Automation Platform 2.6 for RHEL 9","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","packageName":"automation-controller","defaultStatus":"affected","versions":[{"version":"0:4.7.17-1.el9ap","lessThan":"*","versionType":"rpm","status":"unaffected"}],"cpes":["cpe:/a:redhat:ansible_automation_platform:2.6::el10","cpe:/a:redhat:ansible_automation_platform:2.6::el9","cpe:/a:redhat:ansible_automation_platform_developer:2.6::el10","cpe:/a:redhat:ansible_automation_platform_developer:2.6::el9","cpe:/a:redhat:ansible_automation_platform_inside:2.6::el9"]},{"vendor":"Red Hat","product":"Red Hat Ansible Automation Platform 2.6","collectionURL":"https://catalog.redhat.com/software/containers/","packageName":"ansible-automation-platform-26/controller-rhel9","defaultStatus":"affected","versions":[{"version":"1789673739","lessThan":"*","versionType":"rpm","status":"unaffected"}],"cpes":["cpe:/a:redhat:ansible_automation_platform:2.6::el9"]},{"vendor":"Red Hat","product":"Red Hat Ansible Automation Platform 2.7","collectionURL":"https://catalog.redhat.com/software/containers/","packageName":"ansible-automation-platform-27/controller-rhel9","defaultStatus":"affected","versions":[{"version":"1789580684","lessThan":"*","versionType":"rpm","status":"unaffected"}],"cpes":["cpe:/a:redhat:ansible_automation_platform:2.7::el9"]}],"references":[{"url":"https://access.redhat.com/errata/RHSA-2026:71113","name":"RHSA-2026:71113","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2026:71114","name":"RHSA-2026:71114","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2026:71115","name":"RHSA-2026:71115","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2026:71177","name":"RHSA-2026:71177","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2026:71179","name":"RHSA-2026:71179","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-84502","tags":["vdb-entry","x_refsource_REDHAT"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2527096","name":"RHBZ#2527096","tags":["issue-tracking","x_refsource_REDHAT"]}],"datePublic":"2026-09-23T00:00:00.000Z","problemTypes":[{"descriptions":[{"cweId":"CWE-88","description":"Improper Neutralization of Argument Delimiters in a Command ('Argument Injection')","lang":"en","type":"CWE"}]}],"x_redhatCweChain":"CWE-88: Improper Neutralization of Argument Delimiters in a Command ('Argument Injection')","timeline":[{"lang":"en","time":"2026-09-01T21:00:51.893Z","value":"Reported to Red Hat."},{"lang":"en","time":"2026-09-23T00:00:00.000Z","value":"Made public."}],"providerMetadata":{"orgId":"53f830b8-0a3f-465b-8143-3b8a9948e749","shortName":"redhat","dateUpdated":"2026-09-24T05:58:21.514Z"},"x_generator":{"engine":"cvelib 1.8.0"}},"adp":[{"metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2026-09-23T19:29:36.460336Z","id":"CVE-2026-84502","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"title":"CISA ADP Vulnrichment","providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-09-23T19:29:57.569Z"}}]}}