CVE-2026-85475 in Ansible Automation Platform
Summary
by MITRE • 09/23/2026
A flaw was found in the Ansible Automation Platform automation controller. The external logging (rsyslog) configuration is generated by interpolating user-controlled settings — LOG_AGGREGATOR_HOST, LOG_AGGREGATOR_MAX_DISK_USAGE_PATH and LOG_AGGREGATOR_RSYSLOGD_ERROR_LOG_FILE — into an rsyslog RainerScript config file without neutralizing RainerScript syntax. A privileged (superuser) user can inject rsyslog directives, including an omprog action, causing arbitrary command execution inside the control-plane rsyslog component. This allows disclosure of the controller SECRET_KEY and database credentials, decryption of all stored credentials, and full compromise of the control plane.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 09/23/2026
The vulnerability in question represents a critical server-side request forgery and code injection flaw within the Ansible Automation Platform automation controller, specifically affecting its external logging subsystem powered by rsyslog. The core technical deficiency lies in the dynamic generation of the RainerScript configuration file, where user-controlled environment variables such as LOG_AGGREGATOR_HOST, LOG_AGGREGATOR_MAX_DISK_USAGE_PATH, and LOG_AGGREGATOR_RSYSLOGD_ERROR_LOG_FILE are interpolated directly into the script without adequate sanitization or neutralization of special syntax characters. Because rsyslog RainerScript is a powerful configuration language that supports programmatic actions, including the execution of external programs via omprog directives, an attacker with privileged access to these environment variables can inject arbitrary commands. This injection allows for remote code execution within the context of the control-plane rsyslog component, which typically runs with elevated privileges necessary to manage system logs and interact with sensitive infrastructure components.
The operational impact of this vulnerability is severe, leading to a complete compromise of the Ansible Automation Platform's control plane. By exploiting the ability to execute arbitrary commands through the injected rsyslog directives, an attacker can access critical configuration files that contain the controller SECRET_KEY and database credentials. The disclosure of the SECRET_KEY is particularly devastating as it serves as the cryptographic foundation for securing sensitive data within the platform. With this key in hand, an adversary can decrypt all stored credentials, including those used for connecting to managed hosts, cloud providers, and other automation targets. This effectively neutralizes the confidentiality guarantees provided by the platform's credential vaulting mechanism, allowing unauthorized access to a wide array of downstream systems and services that rely on these automated connections.
From a classification perspective, this vulnerability aligns with CWE-94, which describes Improper Control of Generation of Code (Code Injection), specifically involving server-side script injection through unsanitized input in configuration files. Furthermore, the exploitation path maps to MITRE ATT&CK techniques related to Command and Scripting Interpreter abuse, particularly those involving system-level services like rsyslog for lateral movement or privilege escalation within the control plane architecture. The attack vector requires a privileged user, which limits the initial access requirement but significantly increases the blast radius once that threshold is crossed, as it targets the central management node rather than individual endpoints.
Mitigation strategies must focus on both immediate remediation and long-term architectural improvements. Administrators should immediately apply vendor-provided patches or updates to the Ansible Automation Platform that address this specific interpolation flaw. In environments where patching is not instantly feasible, strict input validation should be implemented for all environment variables passed to the logging configuration generator, ensuring that only alphanumeric characters and safe path delimiters are permitted. Additionally, running the rsyslog process with minimized privileges can reduce the impact of successful exploitation by limiting the scope of commands that can be executed within the control plane context. Regular auditing of external logging configurations and restricting who has write access to critical environment variables are also essential defensive measures to prevent unauthorized modification of these settings.