CVE-2026-85475

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-85475", "assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749", "state": "PUBLISHED", "assignerShortName": "redhat", "dateReserved": "2026-09-03T20:33:38.817Z", "datePublished": "2026-09-23T19:40:11.031Z", "dateUpdated": "2026-11-04T23:51:58.456Z"}, "containers": {"cna": {"title": "Automation-controller: automation-controller-container: automation-controller: rsyslog configuration injection via log_aggregator_* settings leads to remote code execution in the control-plane rsyslog component", "metrics": [{"other": {"content": {"value": "Important", "namespace": "https://access.redhat.com/security/updates/classification/"}, "type": "Red Hat severity rating"}}, {"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.2, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "HIGH", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "format": "CVSS"}], "descriptions": [{"lang": "en", "value": "A flaw was found in the Ansible Automation Platform automation controller. The\nexternal logging (rsyslog) configuration is generated by interpolating\nuser-controlled settings \u2014 LOG_AGGREGATOR_HOST, LOG_AGGREGATOR_MAX_DISK_USAGE_PATH\nand LOG_AGGREGATOR_RSYSLOGD_ERROR_LOG_FILE \u2014 into an rsyslog RainerScript config\nfile without neutralizing RainerScript syntax. A privileged (superuser) user can\ninject rsyslog directives, including an omprog action, causing arbitrary command\nexecution inside the control-plane rsyslog component. This allows disclosure of\nthe controller SECRET_KEY and database credentials, decryption of all stored\ncredentials, and full compromise of the control plane."}], "affected": [{"vendor": "Red Hat", "product": "Red Hat Ansible Automation Platform 2.7", "collectionURL": "https://catalog.redhat.com/software/containers/", "packageName": "ansible-automation-platform-27/controller-rhel9", "defaultStatus": "affected", "versions": [{"version": "1789580684", "lessThan": "*", "versionType": "rpm", "status": "unaffected"}], "cpes": ["cpe:/a:redhat:ansible_automation_platform:2.7::el9"]}, {"vendor": "Red Hat", "product": "Red Hat Ansible Automation Platform 2", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "packageName": "ansible-automation-platform-26/controller-rhel9", "defaultStatus": "affected", "cpes": ["cpe:/a:redhat:ansible_automation_platform:2"]}, {"vendor": "Red Hat", "product": "Red Hat Ansible Automation Platform 2", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "packageName": "automation-controller", "defaultStatus": "affected", "cpes": ["cpe:/a:redhat:ansible_automation_platform:2"]}], "references": [{"url": "https://access.redhat.com/errata/RHSA-2026:71177", "name": "RHSA-2026:71177", "tags": ["vendor-advisory", "x_refsource_REDHAT"]}, {"url": "https://access.redhat.com/security/cve/CVE-2026-85475", "tags": ["vdb-entry", "x_refsource_REDHAT"]}, {"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2528255", "name": "RHBZ#2528255", "tags": ["issue-tracking", "x_refsource_REDHAT"]}], "datePublic": "2026-09-23T00:00:00.000Z", "problemTypes": [{"descriptions": [{"cweId": "CWE-96", "description": "Improper Neutralization of Directives in Statically Saved Code", "lang": "en", "type": "CWE"}]}], "x_redhatCweChain": "CWE-96: Improper Neutralization of Directives in Statically Saved Code", "workarounds": [{"lang": "en", "value": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."}], "timeline": [{"lang": "en", "time": "2026-09-03T20:34:04.454Z", "value": "Reported to Red Hat."}, {"lang": "en", "time": "2026-09-23T00:00:00.000Z", "value": "Made public."}], "providerMetadata": {"orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749", "shortName": "redhat", "dateUpdated": "2026-11-04T23:51:58.456Z"}, "x_generator": {"engine": "cvelib 1.8.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-09-24T14:33:34.362171Z", "id": "CVE-2026-85475", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-09-24T14:33:43.369Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-85475", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-09-24T14:33:34.362171Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-09-24T14:33:39.494Z"}}], "cna": {"title": "Automation-controller: automation-controller-container: automation-controller: rsyslog configuration injection via log_aggregator_* settings leads to remote code execution in the control-plane rsyslog component", "metrics": [{"other": {"type": "Red Hat severity rating", "content": {"value": "Important", "namespace": "https://access.redhat.com/security/updates/classification/"}}}, {"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.2, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "HIGH", "confidentialityImpact": "HIGH"}}], "affected": [{"cpes": ["cpe:/a:redhat:ansible_automation_platform:2.7::el9"], "vendor": "Red Hat", "product": "Red Hat Ansible Automation Platform 2.7", "versions": [{"status": "unaffected", "version": "1789580684", "lessThan": "*", "versionType": "rpm"}], "packageName": "ansible-automation-platform-27/controller-rhel9", "collectionURL": "https://catalog.redhat.com/software/containers/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:ansible_automation_platform:2"], "vendor": "Red Hat", "product": "Red Hat Ansible Automation Platform 2", "packageName": "ansible-automation-platform-26/controller-rhel9", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:ansible_automation_platform:2"], "vendor": "Red Hat", "product": "Red Hat Ansible Automation Platform 2", "packageName": "automation-controller", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected"}], "timeline": [{"lang": "en", "time": "2026-09-03T20:34:04.454Z", "value": "Reported to Red Hat."}, {"lang": "en", "time": "2026-09-23T00:00:00.000Z", "value": "Made public."}], "datePublic": "2026-09-23T00:00:00.000Z", "references": [{"url": "https://access.redhat.com/errata/RHSA-2026:71177", "name": "RHSA-2026:71177", "tags": ["vendor-advisory", "x_refsource_REDHAT"]}, {"url": "https://access.redhat.com/security/cve/CVE-2026-85475", "tags": ["vdb-entry", "x_refsource_REDHAT"]}, {"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2528255", "name": "RHBZ#2528255", "tags": ["issue-tracking", "x_refsource_REDHAT"]}], "workarounds": [{"lang": "en", "value": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."}], "x_generator": {"engine": "cvelib 1.8.0"}, "descriptions": [{"lang": "en", "value": "A flaw was found in the Ansible Automation Platform automation controller. The\nexternal logging (rsyslog) configuration is generated by interpolating\nuser-controlled settings \u2014 LOG_AGGREGATOR_HOST, LOG_AGGREGATOR_MAX_DISK_USAGE_PATH\nand LOG_AGGREGATOR_RSYSLOGD_ERROR_LOG_FILE \u2014 into an rsyslog RainerScript config\nfile without neutralizing RainerScript syntax. A privileged (superuser) user can\ninject rsyslog directives, including an omprog action, causing arbitrary command\nexecution inside the control-plane rsyslog component. This allows disclosure of\nthe controller SECRET_KEY and database credentials, decryption of all stored\ncredentials, and full compromise of the control plane."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-96", "description": "Improper Neutralization of Directives in Statically Saved Code"}]}], "providerMetadata": {"orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749", "shortName": "redhat", "dateUpdated": "2026-11-04T23:51:58.456Z"}, "x_redhatCweChain": "CWE-96: Improper Neutralization of Directives in Statically Saved Code"}}, "cveMetadata": {"cveId": "CVE-2026-85475", "state": "PUBLISHED", "dateUpdated": "2026-11-04T23:51:58.456Z", "dateReserved": "2026-09-03T20:33:38.817Z", "assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749", "datePublished": "2026-09-23T19:40:11.031Z", "assignerShortName": "redhat"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"collectionURL": "https://catalog.redhat.com/software/containers/", "cpes": ["cpe:/a:redhat:ansible_automation_platform:2.7::el9"], "defaultStatus": "affected", "packageName": "ansible-automation-platform-27/controller-rhel9", "product": "Red Hat Ansible Automation Platform 2.7", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "1789580684", "versionType": "rpm"}]}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:ansible_automation_platform:2"], "defaultStatus": "affected", "packageName": "ansible-automation-platform-26/controller-rhel9", "product": "Red Hat Ansible Automation Platform 2", "vendor": "Red Hat"}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:ansible_automation_platform:2"], "defaultStatus": "affected", "packageName": "automation-controller", "product": "Red Hat Ansible Automation Platform 2", "vendor": "Red Hat"}], "source": "secalert@redhat.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "A flaw was found in the Ansible Automation Platform automation controller. The\nexternal logging (rsyslog) configuration is generated by interpolating\nuser-controlled settings \u2014 LOG_AGGREGATOR_HOST, LOG_AGGREGATOR_MAX_DISK_USAGE_PATH\nand LOG_AGGREGATOR_RSYSLOGD_ERROR_LOG_FILE \u2014 into an rsyslog RainerScript config\nfile without neutralizing RainerScript syntax. A privileged (superuser) user can\ninject rsyslog directives, including an omprog action, causing arbitrary command\nexecution inside the control-plane rsyslog component. This allows disclosure of\nthe controller SECRET_KEY and database credentials, decryption of all stored\ncredentials, and full compromise of the control plane."}], "id": "CVE-2026-85475", "lastModified": "2026-10-16T12:16:42.060", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.2, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "HIGH", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.2, "impactScore": 5.9, "source": "secalert@redhat.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-85475", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-09-24T14:33:34.362171Z", "version": "2.0.3"}}]}, "published": "2026-09-23T20:17:19.343", "references": [{"source": "secalert@redhat.com", "url": "https://access.redhat.com/errata/RHSA-2026:71177"}, {"source": "secalert@redhat.com", "url": "https://access.redhat.com/security/cve/CVE-2026-85475"}, {"source": "secalert@redhat.com", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2528255"}], "sourceIdentifier": "secalert@redhat.com", "vulnStatus": "Awaiting Analysis", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-96"}], "source": "secalert@redhat.com", "type": "Secondary"}]}

{"bugzilla": {"description": "automation-controller: automation-controller-container: automation-controller: rsyslog configuration injection via LOG_AGGREGATOR_* settings leads to remote code execution in the control-plane rsyslog component", "id": "2528255", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2528255"}, "csaw": false, "cvss3": {"cvss3_base_score": "7.2", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H", "status": "draft"}, "cwe": "CWE-96", "details": ["A flaw was found in the Ansible Automation Platform automation controller. The\nexternal logging (rsyslog) configuration is generated by interpolating\nuser-controlled settings \u2014 LOG_AGGREGATOR_HOST, LOG_AGGREGATOR_MAX_DISK_USAGE_PATH\nand LOG_AGGREGATOR_RSYSLOGD_ERROR_LOG_FILE \u2014 into an rsyslog RainerScript config\nfile without neutralizing RainerScript syntax. A privileged (superuser) user can\ninject rsyslog directives, including an omprog action, causing arbitrary command\nexecution inside the control-plane rsyslog component. This allows disclosure of\nthe controller SECRET_KEY and database credentials, decryption of all stored\ncredentials, and full compromise of the control plane."], "name": "CVE-2026-85475", "package_state": [{"cpe": "cpe:/a:redhat:ansible_automation_platform:2", "fix_state": "Affected", "package_name": "ansible-automation-platform-26/controller-rhel9", "product_name": "Red Hat Ansible Automation Platform 2"}, {"cpe": "cpe:/a:redhat:ansible_automation_platform:2", "fix_state": "Affected", "package_name": "ansible-automation-platform-27/controller-rhel9", "product_name": "Red Hat Ansible Automation Platform 2"}, {"cpe": "cpe:/a:redhat:ansible_automation_platform:2", "fix_state": "Affected", "package_name": "automation-controller", "product_name": "Red Hat Ansible Automation Platform 2"}], "public_date": "2026-09-23T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-85475\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-85475"], "statement": "This flaw requires superuser (administrator) privileges on the automation\ncontroller to reach the external-logging settings API. However, it crosses a\nprivilege boundary: it yields arbitrary command execution and disclosure of the\ncontroller SECRET_KEY and database credentials within the control-plane rsyslog\ncomponent, which is not otherwise accessible to the API superuser role.", "threat_severity": "Important"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": null}], "enrichment": {"confidence": 86.0, "confidence_source": "matching", "scores": [{"score": 86.0, "source": "matching"}]}, "original": {"product": "Red Hat Ansible Automation Platform 2", "source": "cna", "vendor": "Red Hat"}, "product": "ansible_automation_platform", "vendor": "redhat"}], "created": "2026-09-23T20:45:09.997339+00:00", "updated": "2026-09-24T09:00:12.737490+00:00", "vendors": ["redhat", "redhat$PRODUCT$ansible_automation_platform"]}