The vulnerability in Red Hat Ansible Automation Platform's automation-controller arises from insufficient validation of the Project scm_url field. The field accepts values starting with a dash, which are passed verbatim to the git SCM module. Since the git command 'git ls-remote' is run with the URL as a positional argument and without a '--' separator, a URL such as '--upload-pack=<command>:x' is interpreted as a git option that executes the specified command via shell. This allows an attacker with project creation or modification permissions to execute arbitrary commands on the control-plane task pod, leading to cross-tenant compromise and in-cluster lateral movement.

Successful exploitation allows an attacker with limited permissions (create or modify a project in a single organization) to execute arbitrary commands on the control-plane task pod. This can lead to compromise across tenants and lateral movement within the cluster, posing a critical security risk with high confidentiality, integrity, and availability impact.

An official security update is available from Red Hat for Ansible Automation Platform 2.6 that addresses this vulnerability. Users should apply the update as per Red Hat Advisory RHSA-2026:71113 to remediate this issue. No additional mitigation steps are required beyond applying the official patch.