← Vulnerability feed

Vulnerability record · CVE-2026-85475 · published 23 September 2026

CVE-2026-85475: A flaw was found in the Ansible Automation Platform automation controller.

A flaw was found in the Ansible Automation Platform automation controller. The external logging (rsyslog) configuration is generated by interpolating user-controlled settings — LOG_AGGREGATOR_HOST, LOG_AGGREGATOR_MAX_DISK_USAGE_PATH and LOG_AGGREGATOR_RSYSLOGD_ERROR_LOG_FILE — into an rsyslog RainerScript config file without neutralizing RainerScript syntax. A privileged (superuser) user can inject rsyslog directives, including an omprog action, causing arbitrary command execution inside the control-plane rsyslog component. This allows disclosure of the controller SECRET_KEY and database credentials, decryption of all stored credentials, and full compromise of the control plane.

7.2 CVSS 3.1 High EPSS 0.43% · top 65.3% CWE-96 · CWE-96 Awaiting Analysis
7.2CVSS 3.1 base score
0.43%EPSS exploitation probability, 30 days
NoNot in CISA KEV
0Affected product versions listed by NVD
3References
24 Sep 2026Last modified by NVD

Description

A flaw was found in the Ansible Automation Platform automation controller. The external logging (rsyslog) configuration is generated by interpolating user-controlled settings — LOG_AGGREGATOR_HOST, LOG_AGGREGATOR_MAX_DISK_USAGE_PATH and LOG_AGGREGATOR_RSYSLOGD_ERROR_LOG_FILE — into an rsyslog RainerScript config file without neutralizing RainerScript syntax. A privileged (superuser) user can inject rsyslog directives, including an omprog action, causing arbitrary command execution inside the control-plane rsyslog component. This allows disclosure of the controller SECRET_KEY and database credentials, decryption of all stored credentials, and full compromise of the control plane.

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

References

LinkTags
https://access.redhat.com/errata/RHSA-2026:71177
https://access.redhat.com/security/cve/CVE-2026-85475
https://bugzilla.redhat.com/show_bug.cgi?id=2528255

Track CVE-2026-85475 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

10.0CVE-2026-86218N-able N-central pre-auth remote code execution via static code injectionN-central contains a static code injection flaw (CWE-96) that allows remote code execution before authentication. The record states the issue affects…KEVEPSS 13%analysed

Source: NIST National Vulnerability Database (record CVE-2026-85475), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.