Threats Tagged 'ghsa-q3jc-p8r9-qrvp'

CVE-2026-84724 is an argument injection vulnerability in the system-job subsystem of Red Hat Ansible Automation Platform 2.5 for RHEL 8. The flaw arises because the system-job template launch endpoint accepts a user-supplied "days" variable without proper integer validation, allowing spaces in the value to be interpreted as additional command-line arguments. Since system jobs run in-process on the control node without container isolation, an authenticated user with superuser privileges can inject arbitrary arguments into the awx-manage process, influencing its argument vector and module search path. Although full remote code execution requires an additional import gadget not currently present, the vulnerability enables argument injection with control over the process search path. A security update addressing this and other issues is available for Red Hat Ansible Automation Platform 2.6. The CVSS v3.1 base score is 6.6 (medium severity).