Is CVE-2026-84502 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-84502 being exploited in the wild.

How severe is CVE-2026-84502?

Critical severity, with a CVSS score of 9.9, published 23 September 2026.

Is there a fix for CVE-2026-84502?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-84502 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-84502?

Check whether you run Red Hat Ansible Automation Platform. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-84502: Red Hat Ansible Automation Platform controller command injection in project scm_url

CVE-2026-84502 · Severity: critical · CVSS 9.9 · Published 2026-09-23

Red Hat Ansible Automation Platform's automation-controller component fails to validate the scm_url field for project configuration, allowing a user with project creation or modification permissions to inject arbitrary git command-line options. An attacker can craft a malicious URL beginning with a dash that is passed unsafely to git, resulting in arbitrary command execution on the control-plane pod with the ability to compromise multiple tenants and move laterally across the cluster.

Technologies: Red Hat Ansible Automation Platform. Vendors: Red Hat.

Quick answers

Is CVE-2026-84502 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-84502 being exploited in the wild.
How severe is CVE-2026-84502?: Critical severity, with a CVSS score of 9.9, published 23 September 2026.
Which products and versions are affected?: Red Hat Ansible Automation Platform.
Is there a fix for CVE-2026-84502?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-84502 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-84502?: Check whether you run Red Hat Ansible Automation Platform. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability is a command injection flaw in the automation-controller's project scm_url handling. The unsanitized URL is passed directly as a positional argument to git ls-remote without a "--" separator, allowing git option injection (e.g., "--upload-pack=<command>") which are then executed via shell. An authenticated user with permission to create or modify projects can exploit this to achieve arbitrary code execution on the control-plane task pod with cross-tenant and lateral movement capabilities.

Affected products

Red Hat Ansible Automation Platform

Timeline

2026-09-23: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.