This vulnerability involves improper output neutralization for logs in the AAP MCP server component of Red Hat Ansible Automation Platform 2. An unauthenticated attacker can send specially crafted input to the 'toolsetroute' parameter, which is logged without proper sanitization. The injected control characters can manipulate log files by obscuring legitimate entries and inserting forged entries. This log injection vulnerability could be leveraged to mislead operators through social engineering, increasing the risk of executing harmful commands or accessing malicious URLs. The CVSS 3.1 base score is 5.3 (medium severity), reflecting network attack vector, no privileges required, no user interaction, and limited impact on integrity without confidentiality or availability impact. The vendor advisory does not currently specify a patch or remediation status.

The impact is limited to integrity of log data, allowing attackers to inject misleading or forged log entries. This could facilitate social engineering attacks against operators who rely on log data for decision-making. There is no direct confidentiality or availability impact reported. The vulnerability requires no authentication and can be exploited remotely, increasing the attack surface. No known exploits in the wild have been reported.

Patch status is not yet confirmed — check the Red Hat advisory at https://access.redhat.com/security/cve/CVE-2026-6494 for current remediation guidance. Until an official fix is available, organizations should be cautious when reviewing logs from the affected component and consider additional monitoring or filtering of log inputs if feasible. Avoid relying solely on logs for critical operational decisions without corroborating evidence. Follow updates from Red Hat for any forthcoming patches or mitigations.