A flaw was found in the automation-controller input-validation
guard sanitize_jinja(). The function uses two regular
expressions to reject user-supplied Jinja, but the patterns
stop at the first interior '}' or '%' character, so a Jinja
expression containing an inner brace (for example an empty
dict) is accepted while remaining valid Jinja. Because
sanitize_jinja() is the sole guard on several launch-time
fields — ad-hoc command module_args, Machine-credential
username / become_method / become_user, and inventory host
names — a low-privileged user can inject Jinja that ansible-core
evaluates in the execution environment. This enables execution
of arbitrary commands in the execution environment (bypassing an
administrator's AD_HOC_COMMANDS module allowlist) and disclosure
of secrets belonging to credentials the attacker cannot read
(by templating a co-attached credential's injected environment
variables), across the credential access-control boundary.
References
Configurations
No configuration.
History
24 Sep 2026, 06:17
| Type | Values Removed | Values Added |
|---|---|---|
| References |
|
24 Sep 2026, 04:18
| Type | Values Removed | Values Added |
|---|---|---|
| References |
|
23 Sep 2026, 22:16
| Type | Values Removed | Values Added |
|---|---|---|
| References |
|
23 Sep 2026, 20:17
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2026-09-23 20:17
Updated : 2026-09-24 15:17
NVD link : CVE-2026-84714
Mitre link : CVE-2026-84714
CVE.ORG link : CVE-2026-84714
JSON object : View
Products Affected
No product.
CWE
CWE-184
Incomplete List of Disallowed Inputs