CVE-2026-84714

Executive Summary

CVE-2026-84714 is an input-validation flaw (CWE-184, incomplete denylist) in the sanitize_jinja() guard within automation-controller, the component responsible for validating user-supplied Jinja templating before ansible-core evaluates it at launch time. Because the guard's regular expressions stop at the first interior } or % character, a Jinja expression containing an inner brace is accepted by the filter while remaining executable Jinja. A low-privileged authenticated user can therefore bypass the sanitization and inject Jinja into launch-time fields, leading to arbitrary command execution in the execution environment and cross-boundary disclosure of secrets belonging to credentials the attacker cannot read. CVSS v3.1 scores this 7.1 (High), with High confidentiality impact, Low integrity impact, and no availability impact.

Technical Analysis

The vulnerability resides in sanitize_jinja(), an input-validation guard whose stated purpose is to reject user-supplied Jinja before ansible-core processes it. The function relies on two regular expressions, and the core defect is a matching flaw in those patterns: they terminate at the first interior } or % character rather than scanning the entire expression. This means a payload that embeds an inner brace — the description gives an empty dictionary as the canonical example — causes the regex to stop matching early, so the function returns an "accepted" result even though the surrounding string is still syntactically valid and executable Jinja.

This is a textbook CWE-184 (Incomplete List of Disallowed Inputs) issue. The control attempts to enumerate dangerous patterns rather than validate against an allowlist of safe syntax, and its pattern boundaries are incorrect. The guard is the sole protection on several launch-time fields, so its failure is not defense-in-depth degradation but a full bypass for those fields. The fields named in the description are:

• ad-hoc command module_args
• Machine-credential username, become_method, and become_user
• inventory host names

Each of these is user-influenced in ordinary low-privilege workflows, but each is evaluated by ansible-core in the execution environment. When an attacker's Jinja survives sanitize_jinja(), ansible-core's own templating engine faithfully evaluates it. Two distinct impact classes follow from that: command execution (the attacker can template values that cause arbitrary commands to run in the execution environment, stepping around an administrator's AD_HOC_COMMANDS module allowlist) and secret disclosure (by templating a co-attached credential's injected environment variables into a field the attacker can read back, the attacker exfiltrates secrets from a credential object they have no permission to access directly).

The access-control significance is that the sanitizer sits on the trust boundary between an authenticated low-privileged user and the execution environment. The CVSS sub-scores are consistent with this: PR:L (authenticated but unprivileged), AV:N, C:H (secret disclosure), I:L (command execution constrained by the fields and allowlists in play), and A:N. S:U reflects that the impact is scored within the same security authority as the vulnerable component, though the practical effect — reading another credential's secrets — crosses a logical authorization boundary that the product is expected to enforce.

Exploitation Scenarios

No public proof-of-concept, exploit code, or Nuclei template is available for this CVE. The attack chain below is inferred strictly from the vulnerability class and the fields named in the NVD description; no implementation details beyond those names should be assumed.

1. Reconnaissance / target identification. The attacker identifies an automation-controller deployment to which they hold a low-privileged authenticated account. They enumerate what their account is permitted to do: whether ad-hoc command execution is reachable at all, which credentials and inventories they can reference, and which hosts or co-attached credentials share a launch context they can address.

2. Triggering the flaw class. The attacker crafts a Jinja expression that is valid, executable Jinja but contains an interior } or % character — the description's example being an empty dict. Fed into any field guarded solely by sanitize_jinja(), the guard's two regular expressions match only up to the inner brace and conclude the input is benign. The value is accepted and flows through to launch-time evaluation. This is an incomplete denylist bypass, not a memory-safety or parser-differential bug: the sanitizer simply fails to see the whole string.

3. Payload / execution method (vulnerability-class level). Because the accepted value remains valid Jinja, ansible-core evaluates it in the execution environment when the job launches. The attacker chooses the field based on the objective and their permission set: module_args for ad-hoc command execution, Machine-credential username / become_method / become_user for privilege-context manipulation on the managed side, or inventory host names, which are resolved early and can carry templated content. Successful templating in module_args yields arbitrary command execution in the execution environment and defeats an administrator's intent that only allowlisted modules in AD_HOC_COMMANDS be runnable.

4. Post-exploitation impact. Two outcomes documented in the description: (a) execution of arbitrary commands in the execution environment, including modules the AD_HOC_COMMANDS allowlist was meant to prohibit; and (b) disclosure of secrets from credentials the attacker cannot read, achieved by templating a co-attached credential's injected environment variables into an attacker-readable field. Both outcomes persist until the sanitizer is corrected, and neither requires a race condition, user interaction, or administrator action.

Impact Assessment

Business impact is high for organizations that expose automation-controller to multiple user tiers — the standard multi-tenant or delegated-operations model for Ansible Automation Platform deployments. The confidentiality sub-score is High because the flaw lets a low-privileged principal read secrets from credentials outside their authorization boundary; in environments where credentials hold cloud keys, service accounts, or deployment tokens, this is a direct path to lateral movement beyond the automation platform itself. The integrity sub-score is Low, reflecting that command execution is real but constrained by the fields in play and the surrounding execution policy context, rather than an unrestricted root shell on the controller.

Blast radius is determined not by the vulnerability but by credential co-attachment topology. Any inventory or job template in which an attacker-controllable field is evaluated alongside a credential the attacker cannot otherwise read is a potential secret-disclosure path. Environments that grant broad ad-hoc execution rights to many users, or that consolidate high-value credentials into shared inventories, are most exposed. Availability is unaffected (A:N), and exploitation requires authentication (PR:L) with no user interaction (UI:N), over network (AV:N) at low attack complexity (AC:L) — which is precisely why the score reaches 7.1 despite the unpatched status.

Detection Guidance

Sigma Rule

title: Suspicious Jinja Templating in Ansible Automation Controller Launch Fields
id: 7c4a1f92-3b8e-4d51-9a2c-84714cve0001
status: experimental
description: Detects Jinja brace or percent constructs in launch-time fields that
  should have been rejected by sanitize_jinja() (CVE-2026-84714).
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-84714
author: valtersit.com
date: 2026/01/01
logsource:
  product: ansible
  service: automation-controller
detection:
  selection_tokens:
    - '{{'
    - '{%'
  selection_inner_brace:
    - '{{}}'
    - '{%%}'
  selection_fields:
    - 'module_args'
    - 'become_method'
    - 'become_user'
    - 'username'
    - 'host_name'
  condition: selection_tokens and selection_inner_brace and selection_fields
fields:
  - user
  - source_ip
  - field_name
  - raw_value
falsepositives:
  - Legitimate administrative templating that intentionally uses empty-dict syntax
level: high
tags:
  - attack.t1059
  - cve.2026.84714

YARA Rule

rule CVE_2026_84714_Ansible_Jinja_Sanitizer_Bypass
{
    meta:
        description = "Detects Jinja payloads using interior braces to bypass sanitize_jinja() in automation-controller"
        author = "valtersit.com"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-84714"
        date = "2026-01-01"
        severity = "high"

    strings:
        $jinja_open   = "{{"
        $jinja_block  = "{%"
        $empty_dict   = "{{}}"
        $empty_block  = "{%%}"
        $field1       = "module_args"
        $field2       = "become_method"
        $field3       = "become_user"
        $field4       = "sanitize_jinja"

    condition:
        uint32(0) != 0x504b0304 and
        (
            ($jinja_open and $empty_dict) or
            ($jinja_block and $empty_block) or
            (any of ($jinja_open, $jinja_block) and any of ($field1, $field2, $field3))
        )
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-84714 Ansible automation-controller Jinja Sanitizer Bypass Attempt"; flow:established,to_server; http.method; content:"POST"; http.uri; content:"/api/v2/"; http.request_body; content:"{{"; http.request_body; content:"}}"; http.request_body; pcre:"/(module_args|become_method|become_user)"; reference:cve,2026-84714; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-84714; classtype:attempted-admin; sid:8471401; rev:1; metadata:created_at 2026_01_01, updated_at 2026_01_01;)

Elastic Detection

process where event.category == "process" and
  process.parent.name in ("ansible-runner", "ansible-playbook", "awx-manage") and
  process.command_line like~ "*become_method*" and
  process.command_line like~ "*({{*" and
  process.command_line like~ "*}}*"

Splunk SPL Query

index=ansible sourcetype=automation_controller
| search (field_name=module_args OR field_name=become_method OR field_name=become_user OR field_name=username OR field_name=host_name)
| where match(raw_value, "\{\{.*\}\}") OR match(raw_value, "\{%.*%\}") OR match(raw_value, "\{\{\}\}")
| stats count min(_time) as first_seen max(_time) as last_seen by user, src_ip, field_name, raw_value
| convert ctime(first_seen) ctime(last_seen)
| sort - count

Wazuh OSSEC Rule

<group name="ansible,automation_controller,cve_2026_84714">
  <rule id="847140" level="12">
    <decoded_as>json</decoded_as>
    <field name="field_name">module_args|become_method|become_user|username|host_name</field>
    <regex type="pcre2">\{\{.*\}\}|\{%.*%\}|\{\{\}\}</regex>
    <description>CVE-2026-84714: Possible Jinja sanitizer bypass in Ansible automation-controller launch field $(field_name)</description>
    <mitre>
      <id>T1059</id>
    </mitre>
    <group>cve_2026_84714,attack,t1059,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source). No vendor fix or version range has been published in the tracked data, so the guidance below is compensating-control oriented and must be revisited when an advisory appears.

1. Immediate mitigations. Restrict who can reach ad-hoc command execution and job-launch surfaces; remove ad-hoc rights from all but a small, audited administrator group. Audit every field the description identifies as guarded solely by sanitize_jinja() — ad-hoc module_args, Machine-credential username / become_method / become_user, and inventory host names — and, where business use permits, apply input restrictions at a reverse proxy or WAF in front of the controller API. Re-examine credential co-attachment: if a high-value credential is attached to any template or inventory whose fields a low-privileged user can influence, detach or isolate it. Monitor for job launches where these fields contain brace-delimited content. Because no PoC is public and no KEV listing exists, exploitation is currently unlikely to be trivial, but the barrier is low-privilege authentication, not obscurity.

2. Patch/upgrade steps. No patch is available. Track the vendor's advisory channel for automation-controller / automation-platform and upgrade the moment a fixed release is published, giving priority to internet-exposed controllers and multi-tenant deployments. Do not deploy unverified third-party modifications to sanitize_jinja(); because it is the sole guard on these fields, an incorrect local change can either break legitimate templating or silently widen the bypass. Where feasible, validate any interim fix with regression tests that include brace-embedded Jinja payloads in every guarded field.

3. Long-term hardening. Replace the denylist approach with allowlist validation — permit known-safe value shapes for launch-time fields and reject everything else — rather than extending the two regular expressions, since CWE-184 flaws recur whenever a denylist is patched narrowly. Enforce least privilege on ad-hoc execution and AD_HOC_COMMANDS allowlists at the policy layer, separate the security domains of attackers and high-value credentials so co-attachment is architecturally impossible, restrict network exposure of the controller API, enable detailed job-event and API audit logging retained centrally, and add the detection content above to production monitoring ahead of the patch.

References

• NVD — CVE-2026-84714: https://nvd.nist.gov/vuln/detail/CVE-2026-84714
• CWE-184, Incomplete List of Disallowed Inputs: https://cwe.mitre.org/data/definitions/184.html
• FIRST EPSS: not yet scored — no EPSS value available for this CVE
• CISA Known Exploited Vulnerabilities catalog: CVE-2026-84714 is not listed; no known in-the-wild exploitation evidence at time of writing
• Vendor advisory: none published in tracked sources; no patch, workaround, or affected version range available. No public PoC, exploit code, or Nuclei template identified — no threat-actor campaign can be attributed on the available data.