The vulnerability arises from interpolation of user-controlled environment variables (LOG_AGGREGATOR_HOST, LOG_AGGREGATOR_MAX_DISK_USAGE_PATH, LOG_AGGREGATOR_RSYSLOGD_ERROR_LOG_FILE) into an rsyslog RainerScript configuration file without proper neutralization of RainerScript syntax. A superuser on the automation controller can inject malicious rsyslog directives such as omprog actions, enabling arbitrary command execution inside the control-plane rsyslog process. This leads to disclosure of the controller SECRET_KEY and database credentials, allowing decryption of all stored credentials and complete compromise of the control plane. The flaw crosses privilege boundaries, as the control-plane rsyslog component is not otherwise accessible to the API superuser role.

An attacker with superuser privileges on the automation controller can execute arbitrary commands in the control-plane rsyslog component, leading to disclosure of sensitive secrets including the controller SECRET_KEY and database credentials. This enables decryption of all stored credentials and full compromise of the control plane, impacting confidentiality, integrity, and availability of the system.

Red Hat has published an advisory for CVE-2026-85475. The vulnerability requires superuser privileges to exploit, but it crosses privilege boundaries. Check the Red Hat advisory at https://access.redhat.com/security/cve/CVE-2026-85475 for the latest remediation status and apply any official patches or updates provided by Red Hat. If no patch is currently available, monitor the advisory for updates. No alternative mitigations are specified in the advisory.