This vulnerability involves improper output neutralization for logs in the AAP MCP server component of Red Hat Ansible Automation Platform 2. Specifically, the 'toolsetroute' parameter accepts input that is logged without proper sanitization, allowing injection of control characters including newlines and ANSI escape sequences. This log injection can be exploited by unauthenticated remote attackers to manipulate log contents, potentially misleading operators through forged log entries. The CVSS v3.1 base score is 5.3 (medium severity), reflecting network attack vector, no privileges required, no user interaction, and impact limited to integrity (log integrity).

The impact is limited to integrity of log data, where attackers can inject misleading or forged log entries by exploiting unsanitized input in logs. This could facilitate social engineering attacks against operators who rely on log data for decision-making. There is no direct confidentiality or availability impact reported. No known exploits in the wild have been documented.

Patch status is not yet confirmed — check the vendor advisory at https://access.redhat.com/security/cve/CVE-2026-6494 for current remediation guidance. Since no official fix or workaround is indicated in the advisory content provided, users should monitor the vendor site for updates. Until a patch is available, consider restricting access to the affected parameter or enhancing log monitoring to detect suspicious entries if feasible.