Ansible automation-controller: project SCM URL starting with a dash becomes a git --upload-pack command execution

Impact

The Project scm_url field is not checked for values beginning with a dash and is passed verbatim as a positional argument to git ls-remote with no "--" separator. A URL such as "--upload-pack=<command>:x" is parsed by git as an option and run through a shell, so any user who can create or edit a project in a single organization gets arbitrary command execution on the control-plane task pod, with the output conveniently readable through the project update stdout endpoint. The task pod holds credentials and inventory for every organization, so this is a cross-tenant compromise and a lateral-movement foothold inside the cluster that runs the fleet's automation.

Who can reach it

Authenticated user with project create or edit permission in any single organization; no administrator role needed.

What to do

Apply the Red Hat errata for your AAP release (RHSA-2026:71113/71114/71115/71177/71179 cover 2.4 through 2.7) and restart the controller and task services. As an interim measure restrict project create/edit permissions and audit existing projects for scm_url values starting with a dash, then treat the task pod's credentials as exposed and rotate them.

References

Related entries

• Ansible automation-controller: copied workflows keep instance groups, letting a tenant run jobs on the control planeCVE-2026-84719 · Red Hat Ansible Automation Platform automation-controller (workflow deep-copy permission sanitizer)Critical
• GitLab EE: Duo Chat GraphQL subscription leaks Advanced Search config and credentialsCVE-2026-87719 · GitLab EE (Duo Chat GraphQL subscription argument handling)Critical
• GitLab CE/EE: double free parsing a crafted CI/CD regular expression gives code execution on the serverCVE-2026-89078 · GitLab CE/EE (CI/CD config regular-expression parser)Critical
• GitLab CE/EE: integer overflow compiling a crafted CI/CD regular expression gives code execution on the serverCVE-2026-93577 · GitLab CE/EE (CI/CD config regular-expression compiler)Critical
• lldpd (lldp_decode, management addresses): Buffer overflow in lldpd's LLDP decoder via large management addressesCVE-2015-8011 · lldpd (lldp_decode, management addresses)Critical
• Lantronix xPrintServer: The device ships with a hardcoded root account baked into every unit of a given firmware lineCVE-2016-4325 · Lantronix xPrintServerCritical