CVE-2026-84706 Ansible Automation Platform - Command Injection

Ansible Automation Platform automation-controller contains a command injection caused by insufficient environment-variable validation in custom Credential Type injector, letting privileged users execute arbitrary code inside execution-environment containers, exploit requires privileged user access.

CVSS base score 7.6 /10

High

CISA KEV: Not listed
Public exploit: None known
Authentication: Required
EPSS: 0.31% chance of exploitation in 30 days

View the NVD record ↗

Details

Type: Command Injection
Impact: Remote Code Execution
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:H/A:N
Published: 23 September 2026
Updated: 15 October 2026
Weakness: CWE-184

Vendor fix

Update to the latest version with fixed environment-variable validation.

Patching closes this CVE. It does not tell you which of your systems run the affected version, or what else is exposed alongside them.

References

Is CVE-2026-84706 reachable
in your estate?

A CVE describes the software, not your exposure. Panop discovers whether you run the affected product, then tests whether an attacker can actually reach it.

Book a demo Request a scan