Ansible Automation Platform CVE-2026-85475

Requires automation-controller superuser privileges to modify the external logging (rsyslog) configuration - specifically the LOG_AGGREGATOR_HOST, LOG_AGGREGATOR_MAX_DISK_USAGE_PATH, or LOG_AGGREGATOR_RSYSLOGD_ERROR_LOG_FILE settings - which are interpolated into a RainerScript config file without neutralizing RainerScript syntax. External rsyslog logging must be in use so the crafted config is generated and loaded. The exploit is limited by this superuser (PR:H) requirement and does not require user interaction; there is no unauthenticated or low-privilege path in the described flaw.

This is a genuine high-impact flaw whose real-world risk is strongly gated by the privilege requirement. The CVSS 3.1 vector (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H = 7.2) is self-consistent and reasonable: exploitation is remote and low-complexity, but PR:H reflects that only a superuser can set the LOG_AGGREGATOR_* logging settings that are injected into the RainerScript config. The full C:H/I:H/A:H triad is justified because omprog injection yields arbitrary command execution in the control-plane rsyslog process, exposing SECRET_KEY and DB credentials and enabling decryption of every stored credential - effectively total control-plane compromise. No EPSS score, no CISA KEV listing, and no public POC are present in the input, so exploitation status is 'no public exploit identified at time of analysis.' The severity is real but the practical risk is bounded: an attacker who already holds automation-controller superuser rights is largely trusted, so this functions more as a privilege-boundary/defense-in-depth escape (Django app-admin → OS command execution and secret exfiltration) than as a mass-exploitable network flaw. No signals conflict; the main missing data are a fix version and any exploitation telemetry.

A superuser (or an attacker who has compromised a superuser session) edits the external logging settings - e.g. LOG_AGGREGATOR_HOST - embedding RainerScript directives that define an omprog action running an arbitrary shell command. When the controller regenerates the rsyslog config, the injected omprog executes inside the control-plane rsyslog component, letting the attacker read SECRET_KEY and database credentials and decrypt all stored credentials. No public POC is identified in the provided data.