The vulnerability in Red Hat Ansible Automation Platform 2's automation-controller involves the custom Credential Type environment-variable injector. It validates variable names against a deny-list that includes an ANSIBLE_* prefix check and a fixed ENV_BLOCKLIST. However, this deny-list omits important process-hijacking loader variables such as BASH_ENV, ENV, LD_PRELOAD, LD_LIBRARY_PATH, PYTHONSTARTUP, and GIT_SSH_COMMAND. A privileged user can exploit this by writing a malicious script into the execution environment and setting BASH_ENV to point to it, resulting in arbitrary code execution inside the execution-environment container for any job attaching the vulnerable credential type.

An attacker with privileged access can achieve arbitrary code execution inside the execution-environment container of any job that uses the vulnerable credential type. This can lead to compromise of the containerized job environment, potentially affecting confidentiality and integrity of the automation tasks. The CVSS 3.1 score is 7.6 (High), reflecting network attack vector, low attack complexity, required high privileges, no user interaction, and impact on confidentiality and integrity but not availability.

Check the Red Hat advisory at https://access.redhat.com/security/cve/CVE-2026-84706 for official remediation guidance and patch availability. Since no patch links are provided in the input, patch status is not yet confirmed — verify the vendor advisory for current remediation instructions. Until patched, restrict privileged user access to prevent exploitation of this vulnerability.