Red Hat Ansible Automation Platform 2 EUVD-2026-23400

Unauthenticated network-accessible MCP server with the toolsetroute parameter exposed in the request parsing logic. The vulnerability requires no special product configuration, feature enablement, or user interaction - any default deployment of AAP 2 with the MCP server running and accessible to the network is exploitable. No authentication credentials are needed (CVSS PR:N). The attacker must be able to reach the MCP server's HTTP endpoint and identify or guess the toolsetroute parameter name, which is trivial in a disclosed vulnerability context. What limits exploitation: log injection only affects *log output visibility* and does not grant code execution, file access, or system privilege escalation; impact is confined to audit-trail integrity and operator deception. Operators who verify critical commands through out-of-band channels (direct server access, confirmation with change control) are less susceptible to the social engineering vector. AAP deployments with centralized, immutable log collection and integrity verification (e.g., cryptographically signed logs) may detect forged entries post-fact, reducing the window of undetected manipulation.

The CVSS 5.3 score reflects a medium-severity integrity impact (I:L) with no direct confidentiality or availability damage; the attack vector is network-based, unauthenticated, and requires low complexity, but scope is unchanged and the attacker cannot read data or crash the service. However, the real-world risk is elevated by the *social engineering amplification*: forged log entries can deceive human operators into performing out-of-policy actions (executing arbitrary commands, visiting phishing sites), creating a secondary impact chain outside traditional CVSS scope. CVSS inherently underrates log injection because it assumes the log reader is a technical system rather than a human. The lack of active exploitation (no CISA KEV status or public POC at analysis time) suggests this is not currently weaponized, but the attack requires only unauthenticated network access and trivial payload construction (newline + text injection), making it likely to be rapidly exploited once disclosed. Organizations relying on log alerts to trigger incident response are most at risk; those with out-of-band log verification or strict command approval workflows are less vulnerable. The integrity-only impact means this will not trigger automatic service degradation detection.

An attacker sends an HTTP request to the AAP MCP server with a crafted toolsetroute parameter containing payload such as %0a[CRITICAL]%20Reboot%20system%20now (URL-encoded newline followed by fake critical log line). This log entry appears in operator monitoring dashboards and audit logs alongside legitimate entries, falsely suggesting a system anomaly. The operator, seeing what appears to be an authentic automated alert, executes a reboot or other high-risk action. Alternatively, the attacker injects %1b[31m[FAKE]%1b[0m (ANSI color codes) to visually hide legitimate security audit entries, obscuring evidence of unauthorized access attempts while forging benign-looking logs to create a false audit trail.