CVE-2026-85475 is a vulnerability in the Ansible Automation Platform automation controller where the external logging (rsyslog) configuration is generated by interpolating user-controlled environment variables (LOG_AGGREGATOR_HOST, LOG_AGGREGATOR_MAX_DISK_USAGE_PATH, and LOG_AGGREGATOR_RSYSLOGD_ERROR_LOG_FILE) into an rsyslog RainerScript configuration file without neutralizing RainerScript syntax. A privileged (superuser) user can exploit this to inject rsyslog directives, including the omprog action, causing arbitrary command execution inside the control-plane rsyslog component. This leads to disclosure of the controller SECRET_KEY and database credentials, decryption of all stored credentials, and full compromise of the control plane. The vulnerability crosses a privilege boundary, as the control-plane rsyslog component is not otherwise accessible to the API superuser role.

The vulnerability allows a privileged user to execute arbitrary commands within the control-plane rsyslog process, leading to disclosure of highly sensitive information such as the controller SECRET_KEY and database credentials. This enables decryption of all stored credentials and results in full compromise of the control plane, impacting confidentiality, integrity, and availability of the system.

The vulnerability requires superuser privileges to exploit and crosses a privilege boundary within the system. According to the Red Hat advisory, a fix is under investigation or planned, but no explicit patch link is provided in the input data. Patch status is not yet confirmed — check the vendor advisory at https://access.redhat.com/security/cve/CVE-2026-85475 for current remediation guidance. Until a fix is available, restrict superuser access to trusted administrators only and monitor for updates from the vendor.