CVE-2026-84724

Executive Summary

CVE-2026-84724 is an argument-injection flaw (CWE-88) in the system-job subsystem of the Ansible Automation Platform automation-controller. An authenticated attacker holding superuser privileges can supply a malformed days value to the system-job template launch endpoint; because the dispatcher flattens the management-command argument list into a single space-delimited string before the job runner re-splits it, spaces in the value become additional command-line arguments to the control-plane awx-manage process. The demonstrated impact is argument injection with control over the process argument vector and the first entry of its Python module search path, enabling in-process control-plane compromise — though the vendor's own analysis states that confirmed remote code execution additionally requires an import gadget not present in current management commands.

Technical Analysis

The vulnerability resides in the automation-controller's system-job subsystem. System jobs are a distinct class of automation task: unlike other job types, they execute in-process on the control node and are not subject to the container isolation applied to all other job types. That design decision removes the primary containment boundary that would normally blunt injection flaws in this product.

Two independent weaknesses combine to produce the injection:

1. Missing integer validation. The system-job template launch endpoint accepts a user-supplied days variable. Integer validation for this field is defined "elsewhere" in the codebase, but the launch endpoint does not invoke it. The value is therefore stored as supplied rather than being coerced or rejected.

2. Argument flattening and re-splitting. The dispatcher serializes the management-command argument list by joining it into a single string with spaces. Downstream, the job runner re-splits that string on spaces to reconstruct the argument vector. This round-trip is lossy: any space embedded in a value (here, the days variable) is indistinguishable from an argument separator, so a single injected value silently becomes multiple additional arguments.

The net effect is full attacker control of two properties of the spawned awx-manage process: (a) its complete argument vector, and (b) the first entry of its Python module search path. The latter is achieved via Python's documented path option, which prepends a directory to sys.path and thus determines which module implementation the interpreter resolves first.

The NVD description is explicit about the ceiling on demonstrated impact: full remote code execution requires an additional import gadget that is not present in the current management commands. In other words, controlling the search path is necessary but not sufficient for code execution in the analysed code state; what is proven is argument injection and search-path control. Analysts should treat the RCE potential as latent rather than realised — it becomes live the moment any importable gadget (in the management-command import graph or its dependencies, or introduced by a future plugin) exists on the attacker-controlled path.

The triggering endpoint receives the days value from a remote client, which is consistent with the CVSS network attack vector. The requirement for superuser privileges is equally consistent: PR:H reflects that this is an administrative interface, not an unauthenticated surface, and the privileged account is exactly the account permitted to define and launch system jobs. The S:C scope change reflects that the exploited component (the template launch endpoint / dispatcher) grants the attacker authority over a different security authority — the control-node awx-manage process running outside container isolation. CIA subscores are all Low (C:L/I:L/A:L), matching the vendor's conservative framing of demonstrated impact as argument injection and path control rather than guaranteed code execution.

No affected version range, no patch commit hash, no PoC, and no Nuclei template are available in the supplied data. No technical detail beyond the above — function names, file paths, exact endpoint URL, and parameter names other than days — is available and none should be assumed.

Exploitation Scenarios

No public PoC exists for CVE-2026-84724; the chain below is inferred from the vulnerability class (CWE-88, argument injection via normalization round-trip) and the facts stated in the NVD description.

1. Reconnaissance and target identification. An attacker identifies an Ansible Automation Platform automation-controller deployment and obtains credentials for an account with superuser privileges. This is a credentialed, authenticated scenario: the attack surface is the system-job template launch endpoint, which is reachable remotely but gated behind administrative authentication. Passive fingerprinting of the controller's web interface and API is sufficient to confirm the product and the availability of system-job functionality.

2. Triggering the flaw class. The attacker defines or edits a system-job template and supplies a days value that is not a valid integer but contains embedded whitespace. Because the launch endpoint does not run the integer validation defined elsewhere for that field, the value is accepted and stored verbatim. On launch, the dispatcher flattens the management-command argument list into a single space-delimited string. When the job runner re-splits that string, the whitespace inside the days value is interpreted as an argument boundary, and the trailing tokens become independent command-line arguments appended to the awx-manage invocation.

3. Payload/execution method at the vulnerability-class level. By controlling the argument vector, the attacker can append flags to awx-manage. The specific capability called out in the description is Python's path option, which sets the first entry of the module search path. The attacker therefore gains the ability to nominate a directory from which the interpreter will resolve modules before consulting its normal locations. Because the system job runs in-process on the control node with no container isolation, this is control-plane argument injection with control of the process search path — the highest-impact primitive demonstrated. The description does not name any specific management command or reachable import gadget, and no such specific should be assumed.

4. Post-exploitation impact. In the analysed code state, the demonstrated outcome is argument injection and search-path control, not confirmed RCE: no import gadget exists in the current management commands, so simply reordering the search path does not yield arbitrary code execution by itself. Should an appropriate importable gadget exist on, or be placeable on, the attacker-nominated path — now or after a future update — the same primitive would escalate to arbitrary code execution in the control-plane process, with S:C impact across the automation platform's managed estate. Until then, impact is bounded conservatively by the C:L/I:L/A:L subscores: limited but real integrity and availability effects on the control node from manipulated awx-manage arguments.

Because exploitation presupposes superuser credentials, the practical threat model is a malicious or compromised administrator, an insider, or an attacker who has already obtained administrative session material. The flaw is a privilege-consolidation and isolation-escape primitive, not an initial-access vector.

Impact Assessment

Affected systems. Ansible Automation Platform automation-controller deployments that expose the system-job subsystem and its template launch endpoint. All job types other than system jobs are container-isolated and therefore outside this specific impact; the blast radius is the control node itself and, transitively, everything it orchestrates.

Blast radius and scope. The S:C scope-change rating is the key signal. An attacker who gains control of the awx-manage argument vector and module search path has influence over a process running in-process on the control node, without the container isolation applied to every other job type. The control node is the trust root for the entire automation estate: it holds credentials, inventories, and execution authority over managed nodes. Compromise of that process is therefore not a single-host event — it is a platform-level trust boundary failure. The reason this does not score as High is the vendor's own qualifier: arbitrary code execution requires an import gadget absent from current management commands, so the demonstrated impact remains argument injection and search-path control.

CVSS subscores. AV:N — the launch endpoint is reachable over the network. AC:L — no special conditions beyond crafting the value; the flatten/re-split behaviour is deterministic. PR:H — superuser privileges are required, materially narrowing the attacker pool. UI:N — no victim interaction is needed once the template is launched. S:C — impact crosses a security authority boundary (control node vs. isolated job container). C:L/I:L/A:L — limited confidentiality, integrity, and availability impact consistent with argument injection and search-path control rather than confirmed code execution.

Business impact. For organisations using Ansible Automation Platform as their configuration-management and orchestration backbone, a compromised control node means an attacker can potentially influence automated changes across the entire managed fleet. Even without code execution, argument manipulation of awx-manage can perturb control-plane operations, corrupt job state, or induce denial of service. Compliance exposure is significant: the control node typically holds secrets used to authenticate to production systems, so any integrity loss there has audit and regulatory consequences. Because exploitation requires superuser access, the most likely business scenarios are insider threat and post-compromise lateral movement, not opportunistic external attack.

EPSS and exploitation status. FIRST.org has not yet assigned an EPSS score; no value should be inferred or fabricated. CVE-2026-84724 is not in CISA KEV. No public PoC, no exploit code, and no Nuclei template exist. There is no evidence of in-the-wild exploitation or attributed threat-actor campaign in the supplied data.

Detection Guidance

Sigma Rule

title: Ansible Automation Controller System-Job Argument Injection via days Variable (CVE-2026-84724)
id: 8f2c1a44-6b7e-4d19-9c02-ansible84724
status: experimental
description: Detects system-job template launches carrying a non-integer days value with embedded whitespace, indicative of argument injection into awx-manage on the control node.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-84724
author: Valters IT Threat Intelligence
date: 2026/01/01
logsource:
  product: ansible
  service: automation-controller
detection:
  selection_endpoint:
    event.action|contains:
      - 'system_job'
      - 'system-job'
      - 'template'
      - 'launch'
  selection_days_anomaly:
    days|contains:
      - ' '
      - "\t"
      - '--'
  selection_privilege:
    user_is_superuser: true
  condition: selection_endpoint and selection_days_anomaly
fields:
  - user
  - days
  - template_id
  - source_ip
falsepositives:
  - Legitimate administrative tooling that passes padded or quoted values to the days field
level: high
tags:
  - attack.t1190
  - cve.2026.84724

YARA Rule

rule CVE_2026_84724_Ansible_SystemJob_Days_ArgInjection
{
    meta:
        description = "Detects non-integer days values containing whitespace in Ansible automation-controller system-job template definitions, indicative of CVE-2026-84724 argument injection"
        author = "Valters IT Threat Intelligence"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-84724"
        date = "2026-01-01"
        severity = "high"

    strings:
        $sysjob = "system_job" ascii wide nocase
        $days   = "days" ascii wide nocase
        $flag   = "--" ascii wide
        $sp     = " " ascii

    condition:
        $sysjob and $days and (2 of them) and $flag
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-84724 Ansible Automation Controller System-Job days Argument Injection Attempt"; flow:established,to_server; http.method; content:"POST"; http.uri; content:"system"; nocase; http.uri; content:"launch"; nocase; http.request_body; content:"days"; nocase; pcre:"/days[^&]{0,32}[=:][^&]{0,64}[\s]/i"; reference:cve,2026-84724; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-84724; classtype:attempted-admin; sid:202684724; rev:1; metadata:created_at 2026_01_01, updated_at 2026_01_01;)

Elastic Detection

sequence by user.name, source.ip with maxspan=5m
  [authentication where event.action == "user_login" and user.roles : "superuser"]
  [http where event.category == "web" and http.request.method == "POST" and
    http.request.body.text : "*days*" and
    (http.request.body.text regex~ "days[^&]{0,32}[=:][^&]{0,64}\\s")]

Splunk SPL Query

index=ansible_controller sourcetype=automation_controller:api
| search (uri_path="*system*job*" OR uri_path="*launch*") http_method=POST
| rex field=request_body "days[\"']?\s*[:=]\s*[\"']?(?<days_value>[^\"'&]+)"
| where match(days_value, "\s") OR match(days_value, "--")
| stats count min(_time) as first_seen max(_time) as last_seen values(days_value) as injected_values by user, src_ip, uri_path
| convert ctime(first_seen) ctime(last_seen)
| sort - count

Wazuh OSSEC Rule

<group name="ansible,automation_controller,cve-2026-84724,">
  <rule id="847240" level="12">
    <decoded_as>json</decoded_as>
    <field name="uri_path">system.*job|.*launch</field>
    <field name="http_method">POST</field>
    <field name="days" type="pcre2">\s|--</field>
    <description>CVE-2026-84724: Ansible automation-controller system-job days argument injection attempt detected</description>
    <mitre>
      <id>T1190</id>
    </mitre>
    <group>cve_2026_84724,attempted_admin,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 2/4 (CLAIMED — single source claims a patch; not independently confirmed). NVD is the only source asserting a fix, and no vendor advisory, release version, or commit hash is available in the supplied data. Treat patch status as unverified and confirm with the vendor before relying on it.

1. Immediate mitigations.

   • Re-validate days at the launch endpoint: enforce the integer validation that already exists elsewhere for this field, rejecting or coercing any non-integer value. This closes the injection at its source.
   • Eliminate the lossy round-trip: stop flattening the management-command argument list into a space-delimited string and re-splitting it. Pass arguments as a structured array (or use proper argument-vector quoting) so embedded whitespace can never become an argument boundary.
   • Restrict superuser accounts on the automation-controller to the smallest possible set, enforce strong authentication and MFA on those accounts, and alert on new or changed superuser grants. Exploitation requires PR:H, so privilege hygiene directly reduces exposure.
   • Audit existing system-job templates for anomalous days values containing whitespace or leading -- tokens, and review recent launches by superuser accounts.
   • If system jobs are not business-critical, consider disabling the system-job template launch capability pending a confirmed fix.

2. Patch/upgrade steps.

   • Contact Ansible/Red Hat support or monitor the Ansible Automation Platform security advisories page for the CVE-2026-84724 fix and the exact affected-versus-fixed version matrix, since none is published in the data available here.
   • Once a fixed release is identified, schedule an out-of-band upgrade of automation-controller, taking a configuration backup first and validating the system-job template launch behaviour post-upgrade.
   • Re-verify: confirm that a non-integer days value is now rejected by the launch endpoint and that no whitespace survives into the awx-manage argument vector.

3. Long-term hardening.

   • Add automated testing that fuzzes template fields for argument-injection round-trip behaviour, with a regression test specifically asserting that whitespace in days cannot produce additional arguments.
   • Reduce reliance on in-process system jobs: wherever possible, move privileged control-plane operations into the same container isolation applied to other job types, so that a future injection of this class does not sit on the control node's argument vector.
   • Constrain the Python module search path for awx-manage to a fixed, immutable set of directories, so that no user-influenced path entry can ever precede trusted modules. This neutralises the search-path-control primitive even if an argument-injection bug recurs.
   • Apply least privilege to the service account running awx-manage and monitor for unexpected argument vectors or module-path deviations.
   • Maintain continuous monitoring with the detection rules above, and subscribe to vendor advisories for the Ansible Automation Platform.

References

• NVD — CVE-2026-84724: https://nvd.nist.gov/vuln/detail/CVE-2026-84724
• CWE-88 — Improper Neutralization of Argument Delimiters in a Command ('Argument Injection'): https://cwe.mitre.org/data/definitions/88.html
• MITRE ATT&CK T1190 — Exploit Public-Facing Application: https://attack.mitre.org/techniques/T1190/
• Ansible Automation Platform security advisories (vendor advisory page — confirm CVE-2026-84724 fix status directly): https://access.redhat.com/security/security-updates/
• CISA Known Exploited Vulnerabilities Catalog (CVE-2026-84724 not listed as of this report): https://www.cisa.gov/known-exploited-vulnerabilities-catalog

Threat actor and exploit-in-the-wild status: No public PoC, no exploit code, no Nuclei template, and no evidence of in-the-wild exploitation or attributed threat-actor campaign appear in the available data. CVE-2026-84724 is not in CISA KEV. FIRST.org has not yet assigned an EPSS score. The attack chain described in this report is inferred from the vulnerability class and the NVD description only.