automation-controller: sanitize_jinja bypass lets a low-privileged user run Jinja in the execution environment

Impact

automation-controller's sanitize_jinja() is the only guard on several launch-time fields - ad-hoc command module_args, Machine-credential username, become_method and become_user, and inventory host names - and its two regexes stop at the first interior '}' or '%'. A Jinja expression containing an inner brace (an empty dict, for example) passes the filter while remaining valid Jinja, and ansible-core then evaluates it inside the execution environment. A low-privileged controller user therefore gets arbitrary command execution in the execution environment, bypassing the administrator's AD_HOC_COMMANDS module allowlist, and can read secrets from credentials they have no permission to view by templating a co-attached credential's injected environment variables. For a fleet operator this is the credential boundary of the thing that configures the fleet: automation-controller typically holds SSH keys, BMC credentials and cloud tokens for every GPU node, so this is a path from a limited automation account to the keys for the datacenter.

Who can reach it

Network, authenticated, low privilege (CVSS AV:N/PR:L): any controller user who can launch an ad-hoc command, define a Machine credential, or add an inventory host name. No admin role and no host access needed.

What to do

Apply the Red Hat errata for your release - RHSA-2026:71113, 71114, 71177 and 71179 cover Ansible Automation Platform 2.5 on RHEL 8/9 and 2.6/2.7 - then restart the automation-controller services. This is a control-plane service update, not a fleet-wide reboot. Until it is applied, tighten who holds job-launch and credential-attach permissions, and treat any credential co-attached to jobs runnable by low-privileged users as potentially disclosed - rotate the ones that matter (node SSH keys, BMC and cloud credentials).

References

Related entries

• Linux kernel nfsd: stale opcnt after compound release leaks adjacent slab memory through the RPC status netlink dumpCVE-2026-89691 · Linux kernel nfsd (nfsd4_release_compoundargs, RPC status netlink interface)High
• Linux kernel nfsd: dispatch error paths leave the status seqlock counter odd, exposing mutating compound stateCVE-2026-89705 · Linux kernel nfsd (nfsd_dispatch rq_status_counter seqlock protocol)High
• Harness: missing space-scoped access control lets any authenticated user read other spaces' infra provider configsCVE-2026-92750 · Harness (infrastructure provider read endpoint, /api/v1/infraproviders)High
• MinIO: unsigned x-amz-copy-source on a presigned PUT URL turns one-object write into a read of any objectCVE-2026-97731 · MinIO (SigV4 signed-header validation, extractSignedHeaders)High
• Flux CD (allow-webhooks NetworkPolicy, notification-controller event server): CROSS-TENANT EVENT FORGERY: theNCVD-2026-057-flux-cd-allow-webhooks-networkpo · Flux CD (allow-webhooks NetworkPolicy, notification-controller event server)High
• OpenSSH through 10.0 - mm_answer_authpassword uses an integer 'authenticated' flag that does not resist a single bitCVE-2023-51767 · OpenSSH through 10.0 - mm_answer_authpassword uses an integer 'authenticated' flag that does not resist a single bit…High