CVE-2026-84706 describes a security flaw in the Ansible Automation Platform's automation-controller component. The vulnerability arises from the environment-variable injector for custom Credential Types, which validates variable names against a deny-list that fails to block critical process-hijacking loader variables such as BASH_ENV, ENV, LD_PRELOAD, LD_LIBRARY_PATH, PYTHONSTARTUP, and GIT_SSH_COMMAND. A privileged user can exploit this by writing an attacker-controlled script into the execution environment and setting BASH_ENV to point to it, resulting in arbitrary code execution within the execution-environment container for any job using the affected credential type.

An attacker with privileged access can achieve arbitrary code execution inside the execution-environment container of Ansible Automation Platform jobs that use the vulnerable credential type. This could lead to compromise of the job execution environment and potentially further escalation within the automation infrastructure. The CVSS score is 7.6 (High), indicating significant impact on confidentiality and integrity without user interaction required.

An official fix is available as per the Red Hat advisory RHSA-2026:71113. Users should apply the update for Red Hat Ansible Automation Platform 2.6 to remediate this vulnerability. The vendor advisory provides detailed patch information and users are advised to follow the official update process to ensure the vulnerability is addressed.