CVE-2026-84724 in Ansible Automation Platform
Summary
by MITRE • 09/23/2026
An argument-injection flaw was found in the Ansible Automation Platform automation-controller system-job subsystem. The system-job template launch endpoint stores a user-supplied "days" variable without running the integer validation defined elsewhere for that field, and the dispatcher flattens the management-command argument list into a single string with spaces before the job runner re-splits it, so spaces in the value become additional command-line arguments. Because system jobs are executed in-process on the control node without the container isolation applied to all other job types, an authenticated user with superuser privileges can inject arbitrary arguments — including Python's path option — into the control-plane awx-manage process, controlling its argument vector and the first entry of its module search path. Full remote code execution requires an additional import gadget that is not present in the current management commands, so the demonstrated impact is argument injection with control of the process search path rather than confirmed code execution.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 09/23/2026
The vulnerability identified within the Ansible Automation Platform automation-controller system-job subsystem represents a critical argument-injection flaw rooted in improper input validation and unsafe command construction practices. The core technical issue lies in how the system-job template launch endpoint handles user-supplied data, specifically the days variable associated with job scheduling parameters. While other parts of the application enforce strict integer validation for this field to ensure it contains only numeric values, the specific code path triggered by launching a system job fails to apply these same safeguards. This inconsistency allows an attacker to inject non-numeric characters, particularly spaces, into the parameter value without triggering immediate rejection or sanitization routines that would normally prevent such input from reaching lower-level execution layers.
The operational mechanism of this vulnerability exploits how the dispatcher component processes and forwards arguments to the job runner. The management-command argument list is flattened into a single string separated by spaces before being passed along for processing. When the job runner subsequently re-splits this string back into individual command-line arguments, any space characters embedded within the user-supplied days variable are interpreted as delimiters between distinct arguments rather than as part of a single value. This parsing behavior effectively allows an authenticated superuser to manipulate the argument vector of the awx-manage process running on the control node. Because system jobs execute in-process directly on the control plane without the container isolation that protects other job types, this manipulation has direct access to the host environment's execution context.
The impact of this flaw extends beyond simple parameter injection due to the specific nature of Python application execution. By controlling the argument vector, an attacker can influence critical aspects of the awx-manage process initialization, including its module search path via options such as -p or PYTHONPATH. This capability allows for significant control over which modules are loaded and executed by the management command. Although a full remote code execution chain requires additional import gadgets that are not currently present in standard management commands, the ability to inject arbitrary arguments and manipulate the environment variables governing module loading constitutes a severe security compromise. It enables an attacker with superuser privileges to potentially load malicious libraries or alter runtime behavior, creating a pathway for further exploitation if suitable gadget chains were available or if other application features could be leveraged in conjunction with this injection vector.
From a classification perspective, this vulnerability aligns closely with CWE-78 Improper Neutralization of Special Elements used in an OS Command and CWE-20 Improper Input Validation. The failure to validate the days field as strictly numeric before use violates fundamental input validation principles, while the subsequent splitting logic demonstrates a lack of proper neutralization for special elements like spaces that have semantic meaning in command-line parsing. In terms of attack tactics, this aligns with MITRE ATT&CK techniques related to Command and Scripting Interpreter abuse, specifically where an adversary manipulates arguments passed to system processes to achieve unauthorized execution or configuration changes. The distinction between containerized job runners and the in-process nature of system jobs highlights a critical architectural risk where privilege escalation is facilitated by bypassing isolation boundaries through argument manipulation rather than direct process injection.
Mitigation strategies must address both the immediate code flaw and broader architectural risks. Immediately, developers should enforce strict integer validation on the days variable at the point of entry within the system-job template launch endpoint to ensure that only numeric values are accepted, thereby preventing space characters from being injected into the argument string. Additionally, command construction logic should be refactored to avoid flattening arguments into a single delimited string; instead, passing arguments as distinct array elements or using safe execution APIs would prevent re-splitting errors from introducing unintended parameters. Long-term remediation involves reviewing all system-job executions for similar validation gaps and considering whether in-process execution is strictly necessary compared to containerized alternatives that provide stronger isolation boundaries against such injection attacks.