Is CVE-2026-84706 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-84706 being exploited in the wild.

How severe is CVE-2026-84706?

High severity, with a CVSS score of 7.6, published 23 September 2026.

Is there a fix for CVE-2026-84706?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-84706 attacked?

It is attacked over the network.

Am I affected by CVE-2026-84706?

Check whether you run Red Hat Ansible Automation Platform automation-controller. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-84706: Red Hat Ansible Automation Platform automation-controller credential type injection

CVE-2026-84706 · Severity: high · CVSS 7.6 · Published 2026-09-23

A flaw in Ansible Automation Platform's automation-controller allows privileged users to inject environment variables that bypass security restrictions. An attacker can write malicious scripts and use loader variables like BASH_ENV to execute arbitrary code within job execution environments, compromising the security of automated workflows.

Vendors: Red Hat.

Quick answers

Is CVE-2026-84706 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-84706 being exploited in the wild.
How severe is CVE-2026-84706?: High severity, with a CVSS score of 7.6, published 23 September 2026.
Which products and versions are affected?: Red Hat Ansible Automation Platform automation-controller.
Is there a fix for CVE-2026-84706?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-84706 attacked?: It is attacked over the network.
Am I affected by CVE-2026-84706?: Check whether you run Red Hat Ansible Automation Platform automation-controller. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The custom Credential Type environment-variable injector uses an incomplete deny-list (checking only ANSIBLE_* prefix and a fixed ENV_BLOCKLIST) that fails to block process-hijacking loader variables such as BASH_ENV, ENV, LD_PRELOAD, LD_LIBRARY_PATH, PYTHONSTARTUP, and GIT_SSH_COMMAND. A privileged user can combine this with the credential file injector to write attacker-controlled scripts into the execution environment and point BASH_ENV at it, achieving arbitrary code execution inside the execution-environment container.

Affected products

Red Hat Ansible Automation Platform automation-controller

Timeline

2026-09-23: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.