CVE-2026-85475: Automation-controller: automation-controller-container: automation-controller: rsyslog configuration injection via log_aggregator_* settings leads to remote code execution in the control-plane rsyslog component

Severity: high (CVSS 7.2 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.8% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-09-23 · updated 2026-10-16
Weakness: CWE-96

Description

A flaw was found in the Ansible Automation Platform automation controller. The external logging (rsyslog) configuration is generated by interpolating user-controlled settings — LOG_AGGREGATOR_HOST, LOG_AGGREGATOR_MAX_DISK_USAGE_PATH and LOG_AGGREGATOR_RSYSLOGD_ERROR_LOG_FILE — into an rsyslog RainerScript config file without neutralizing RainerScript syntax. A privileged (superuser) user can inject rsyslog directives, including an omprog action, causing arbitrary command execution inside the control-plane rsyslog component. This allows disclosure of the controller SECRET_KEY and database credentials, decryption of all stored credentials, and full compromise of the control plane.

Affected products

Red Hat Ansible Automation Platform 2: all versions
Red Hat Ansible Automation Platform 2.7: all versions — fixed in 1789580684

How to fix

Upgrade to a fixed version: Red Hat Ansible Automation Platform 2.7 1789580684. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2026-85475 or the next vulnerability affects your stack