CVE-2026-84709

{}

{}

{}

{"affected_release": [{"advisory": "RHSA-2026:71113", "cpe": "cpe:/a:redhat:ansible_automation_platform:2.6::el9", "package": "automation-controller-0:4.7.17-1.el9ap", "product_name": "Red Hat Ansible Automation Platform 2.6 for RHEL 9", "release_date": "2026-09-23T00:00:00Z"}], "bugzilla": {"description": "automation-controller: automation-controller: CredentialType injector validation renders attacker-supplied Jinja2 templates synchronously in the web worker, allowing uncontrolled resource consumption (denial of service) and an unhandled-exception (500) via /api/controller/v2/credential_types/", "id": "2527191", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2527191"}, "csaw": false, "cvss3": {"cvss3_base_score": "4.9", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H", "status": "verified"}, "cwe": "CWE-1050", "details": ["A flaw was found in Red Hat Ansible Automation Platform's automation-controller. When a\ncustom credential type is created or updated, the injector configuration is validated by\nrendering each attacker-supplied Jinja2 template synchronously inside the web request\nworker, with no limit on iteration count, output size, or execution time. An\nauthenticated superuser can submit a credential type whose injector contains deeply\nnested loops or large string operations, consuming CPU and wall-clock time in the web\nworker until it is killed by the request timeout; issuing enough concurrent requests\nplaces all web workers into a kill-and-respawn loop, making the Controller API and UI\nunavailable for the duration of the attack. Additionally, certain template constructs\nraise exception types that the validator does not handle, resulting in an unhandled\nserver error (HTTP 500) instead of a clean validation error. The rendering sandbox\nprevents code execution, so there is no confidentiality or integrity impact."], "name": "CVE-2026-84709", "package_state": [{"cpe": "cpe:/a:redhat:ansible_automation_platform:2", "fix_state": "Affected", "package_name": "ansible-automation-platform-26/controller-rhel9", "product_name": "Red Hat Ansible Automation Platform 2"}, {"cpe": "cpe:/a:redhat:ansible_automation_platform:2", "fix_state": "Affected", "package_name": "ansible-automation-platform-27/controller-rhel9", "product_name": "Red Hat Ansible Automation Platform 2"}], "public_date": "2026-09-23T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-84709\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-84709"], "statement": "This flaw affects automation-controller as shipped in Red Hat Ansible Automation\nPlatform. Exploitation requires an authenticated superuser, and the rendering sandbox\nprevents code execution, so there is no confidentiality or integrity impact; the impact\nis a denial of service of the Controller web tier while the attack is sustained, plus an\nunhandled server error. Red Hat rates this Moderate. The recommended fix is to validate\ninjector templates by inspecting the parsed template (parse, do not render), or to bound\nrendering with a hard wall-clock/iteration/output limit and reject loop/extends/include/\nimport constructs, and to broaden exception handling so all failures surface as clean\nvalidation errors rather than HTTP 500.", "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "2.6"}}], "enrichment": {"confidence": 100.0, "confidence_source": "inferred", "scores": [{"score": 100.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "product": "ansible_automation_platform", "vendor": "redhat"}], "created": "2026-09-24T03:15:05.547655+00:00", "updated": "2026-09-24T18:00:19.260473+00:00", "vendors": ["redhat", "redhat$PRODUCT$ansible_automation_platform"]}