CVE-2026-85475

Executive Summary

CVE-2026-85475 is a command injection vulnerability in the Ansible Automation Platform automation controller, arising from improper neutralization of RainerScript syntax within external logging (rsyslog) configuration settings. A superuser can inject arbitrary rsyslog directives—including an omprog action—to achieve arbitrary command execution under the control-plane rsyslog component. Successful exploitation allows disclosure of the controller SECRET_KEY and database credentials, decryption of all stored credentials, and full compromise of the control plane.

Technical Analysis

The vulnerability resides in the generation of the external logging (rsyslog) configuration. The automation controller dynamically constructs an rsyslog RainerScript configuration file by interpolating settings that are user-controllable by a privileged (superuser) account: LOG_AGGREGATOR_HOST, LOG_AGGREGATOR_MAX_DISK_USAGE_PATH, and LOG_AGGREGATOR_RSYSLOGD_ERROR_LOG_FILE. Because these values are inserted into the configuration without neutralizing RainerScript syntax, a superuser can break out of the intended string or directive context and inject additional rsyslog directives.

RainerScript supports powerful directives, including the omprog output module, which executes an external program and pipes log data to it. By injecting an omprog action, the attacker causes the rsyslog process to execute an arbitrary command with the privileges of that process (typically root or a highly privileged service account on the control plane). This is a classic configuration injection flaw mapped to CWE-96 (Improper Neutralization of Directives in Statically Saved Code), where user input is written into a configuration or code file that is later interpreted.

The attack surface is the automation controller’s settings interface or API for external logging configuration, accessible only to superusers. The vulnerability does not require network-level authentication bypass, but it does require an authenticated privileged account. Once the configuration is saved and rsyslog is reloaded (either automatically or via a restart), the injected directives take effect. The impact is severe: the rsyslog component runs on the control plane, and its command execution context may allow reading environment files, configuration files containing the SECRET_KEY, and database connection strings. With the SECRET_KEY, an attacker can decrypt all stored credentials managed by the controller, including machine credentials, cloud credentials, and vault secrets.

The CVSS vector (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) reflects a network-reachable flaw requiring high privileges, with low attack complexity and high confidentiality, integrity, and availability impact. The scope is unchanged, meaning the vulnerable component and impacted component are the same (the control plane), but the downstream effect (credential decryption) extends beyond the immediate component, potentially affecting all managed nodes and integrated systems.

Exploitation Scenarios

1. Reconnaissance and target identification: An attacker who has already obtained superuser credentials (through phishing, credential stuffing, or prior compromise) identifies the Ansible Automation Platform automation controller. This is typically a web-accessible service on port 443 or 80. The attacker confirms access to the administration settings for external logging.

2. Triggering the flaw class: The attacker navigates to the external logging configuration settings. These settings include the parameters LOG_AGGREGATOR_HOST, LOG_AGGREGATOR_MAX_DISK_USAGE_PATH, and LOG_AGGREGATOR_RSYSLOGD_ERROR_LOG_FILE. The attacker supplies a value that includes RainerScript syntax designed to break out of the intended assignment. For example, a value may include a newline followed by an omprog directive that specifies a command to execute. Because the configuration is generated by interpolating the user-controlled value without neutralization, the injected directives become part of the active rsyslog configuration.

3. Payload and execution: The attacker uses the omprog action to specify a command. When rsyslog processes the configuration—upon reload or restart—it executes the command. The command runs with the privileges of the rsyslog process, which on the control plane is often root or a dedicated service account with broad read access. The attacker can execute a reverse shell, download a second-stage payload, or simply read sensitive files.

4. Post-exploitation impact: The attacker uses the command execution to read the controller’s SECRET_KEY and database credentials. These are typically stored in configuration files or environment variables accessible to the rsyslog process. With the SECRET_KEY, the attacker decrypts all stored credentials in the controller database. This grants access to managed hosts, cloud environments, and other integrated systems. The attacker can then move laterally, establish persistence, or exfiltrate data. Full control plane compromise is achieved, allowing the attacker to modify playbooks, execute arbitrary jobs across the managed estate, and disable logging or monitoring.

No public proof-of-concept or exploit code is available; the attack chain is inferred from the vulnerability class and the NVD description.

Impact Assessment

The business impact is critical. The automation controller is the central orchestration point for Ansible Automation Platform, often managing thousands of servers, network devices, and cloud resources. Compromise of the control plane allows an attacker to:

• Decrypt and steal all stored credentials (machine, cloud, vault, etc.).
• Execute arbitrary commands on the controller itself, and subsequently on all managed nodes via Ansible jobs.
• Modify or destroy automation workflows, causing operational disruption.
• Maintain persistent access by injecting malicious playbooks or credentials.

The CVSS subscores indicate high confidentiality (C:H), high integrity (I:H), and high availability (A:H) impact. The attack vector is network (AV:N), attack complexity is low (AC:L), privileges required are high (PR:H), and no user interaction is needed (UI:N). The scope is unchanged (S:U), meaning the vulnerable component and impacted component are the same, but the downstream blast radius includes all systems managed by the controller.

Affected systems are any deployment of the Ansible Automation Platform automation controller where external logging is configured and superuser access is available to an attacker. The lack of a published patch increases risk, as no official fix is available.

Detection Guidance

Sigma Rule

title: Ansible Automation Platform Rsyslog Configuration Injection
id: 8f9a2b3c-4d5e-6f7a-8b9c-0d1e2f3a4b5c
status: experimental
description: Detects attempts to exploit CVE-2026-85475 by injecting RainerScript directives into external logging settings.
author: Threat Intelligence
date: 2026/01/01
logsource:
  product: ansible
  service: automation_controller
detection:
  selection:
    event:
      - "external_logging_configuration_updated"
      - "settings_changed"
    setting_name:
      - "LOG_AGGREGATOR_HOST"
      - "LOG_AGGREGATOR_MAX_DISK_USAGE_PATH"
      - "LOG_AGGREGATOR_RSYSLOGD_ERROR_LOG_FILE"
    setting_value|contains:
      - "omprog"
      - "action("
      - "if "
      - "then "
      - "template("
  condition: selection
falsepositives:
  - Legitimate rsyslog configuration with advanced directives by administrators
level: high

YARA Rule

rule CVE_2026_85475_Rsyslog_Injection
{
    meta:
        description = "Detects RainerScript injection attempts in Ansible Automation Platform logging configuration files"
        author = "Threat Intelligence"
        reference = "CVE-2026-85475"
        date = "2026-01-01"
    strings:
        $omprog = "omprog" nocase
        $action = "action(" nocase
        $template = "template(" nocase
        $if_then = "if " nocase
        $log_aggregator = "LOG_AGGREGATOR_" nocase
    condition:
        any of ($omprog, $action, $template) and $log_aggregator
}

Suricata IDS Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2026-85475 Ansible Automation Platform Rsyslog Configuration Injection Attempt"; flow:to_server,established; content:"LOG_AGGREGATOR_HOST"; http_client_body; content:"omprog"; http_client_body; distance:0; within:100; classtype:attempted-admin; sid:10000001; rev:1;)

Elastic Detection

sequence by host.id, user.name with maxspan=5m
  [any where event.category == "configuration" and event.action == "change" and
   process.name == "ansible-automation-controller" and
   (message contains "LOG_AGGREGATOR_HOST" or message contains "LOG_AGGREGATOR_MAX_DISK_USAGE_PATH" or message contains "LOG_AGGREGATOR_RSYSLOGD_ERROR_LOG_FILE")]
  [any where event.category == "process" and event.action == "start" and
   process.parent.name == "rsyslogd" and
   (process.command_line contains "sh" or process.command_line contains "bash" or process.command_line contains "curl" or process.command_line contains "wget")]

Splunk SPL Query

index=ansible_controller sourcetype=automation_controller:settings
(LOG_AGGREGATOR_HOST="*" OR LOG_AGGREGATOR_MAX_DISK_USAGE_PATH="*" OR LOG_AGGREGATOR_RSYSLOGD_ERROR_LOG_FILE="*")
| eval suspicious=mvfilter(match(LOG_AGGREGATOR_HOST, "omprog|action\(|template\(|if .* then") OR match(LOG_AGGREGATOR_MAX_DISK_USAGE_PATH, "omprog|action\(|template\(|if .* then") OR match(LOG_AGGREGATOR_RSYSLOGD_ERROR_LOG_FILE, "omprog|action\(|template\(|if .* then"))
| where suspicious=1
| table _time, user, src_ip, LOG_AGGREGATOR_HOST, LOG_AGGREGATOR_MAX_DISK_USAGE_PATH, LOG_AGGREGATOR_RSYSLOGD_ERROR_LOG_FILE

Wazuh OSSEC Rule

<group name="ansible,automation_controller,">
  <rule id="100001" level="12">
    <decoded_as>json</decoded_as>
    <field name="event_type">external_logging_configuration_updated</field>
    <field name="LOG_AGGREGATOR_HOST">\.*omprog|action\(|template\(|if .* then\.*</field>
    <description>CVE-2026-85475: Ansible Automation Platform rsyslog configuration injection attempt detected in LOG_AGGREGATOR_HOST</description>
    <mitre>
      <id>T1190</id>
    </mitre>
  </rule>
  <rule id="100002" level="12">
    <decoded_as>json</decoded_as>
    <field name="event_type">external_logging_configuration_updated</field>
    <field name="LOG_AGGREGATOR_MAX_DISK_USAGE_PATH">\.*omprog|action\(|template\(|if .* then\.*</field>
    <description>CVE-2026-85475: Ansible Automation Platform rsyslog configuration injection attempt detected in LOG_AGGREGATOR_MAX_DISK_USAGE_PATH</description>
    <mitre>
      <id>T1190</id>
    </mitre>
  </rule>
  <rule id="100003" level="12">
    <decoded_as>json</decoded_as>
    <field name="event_type">external_logging_configuration_updated</field>
    <field name="LOG_AGGREGATOR_RSYSLOGD_ERROR_LOG_FILE">\.*omprog|action\(|template\(|if .* then\.*</field>
    <description>CVE-2026-85475: Ansible Automation Platform rsyslog configuration injection attempt detected in LOG_AGGREGATOR_RSYSLOGD_ERROR_LOG_FILE</description>
    <mitre>
      <id>T1190</id>
    </mitre>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source).

1. Immediate mitigations:

   • Restrict superuser access to the automation controller to only trusted, essential personnel.
   • Enforce multi-factor authentication for all administrative accounts.
   • Monitor configuration changes to LOG_AGGREGATOR_HOST, LOG_AGGREGATOR_MAX_DISK_USAGE_PATH, and LOG_AGGREGATOR_RSYSLOGD_ERROR_LOG_FILE for suspicious RainerScript syntax.
   • If external logging is not required, disable it entirely.
   • Consider running the rsyslog process with minimal privileges (e.g., as a non-root user) to limit post-exploitation impact, though this may not fully prevent the injection.
   • Isolate the automation controller network from untrusted networks and limit administrative access to a dedicated management VLAN.

2. Patch/upgrade steps:

   • No patch is currently available. Monitor the vendor’s security advisories for Ansible Automation Platform and apply updates as soon as they are released.
   • Subscribe to Red Hat security announcements and the Ansible Automation Platform release notes.

3. Long-term hardening:

   • Implement strict input validation and output encoding for all configuration settings that are interpolated into system files.
   • Adopt a secure configuration management practice that separates user-supplied data from executable directives.
   • Conduct regular security reviews of configuration generation code, especially where user input is written into interpreted files.
   • Use application allowlisting and file integrity monitoring on the rsyslog configuration directory to detect unauthorized changes.
   • Apply the principle of least privilege to all service accounts, particularly those running logging and monitoring components.

References

• NVD – CVE-2026-85475: https://nvd.nist.gov/vuln/detail/CVE-2026-85475
• Red Hat Ansible Automation Platform Security Advisories: https://access.redhat.com/security/
• CWE-96: Improper Neutralization of Directives in Statically Saved Code: https://cwe.mitre.org/data/definitions/96.html
• MITRE ATT&CK T1190: Exploit Public-Facing Application: https://attack.mitre.org/techniques/T1190/
• Rsyslog RainerScript Documentation: https://www.rsyslog.com/doc/configuration/rainerscript/index.html

No known threat actor campaigns or exploit-in-the-wild evidence are available for this CVE at this time.