Ansible Automation Platform EUVD-2026-85560

Requires an authenticated user who holds permission to create or modify a Project within at least one organization in Red Hat Ansible Automation Platform 2 automation-controller; no admin or cross-org rights are needed. The attacker must set the Project scm_url to a value beginning with a dash (e.g. '--upload-pack=<command>:x') and trigger a project update using the git SCM module, which runs git ls-remote with the URL as a positional argument and without a -- separator. Limiting factors: exploitation needs the git SCM project type and the low-privilege project-management role; it affects default configurations of the git-based project update path, so no non-default setting is required, but valid platform credentials are.

This is a genuine high-priority flaw, not a CVSS-inflated one. The vendor CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H = 9.9) is well-supported by the description: an argument-injection bug (CWE-88) where an attacker-controlled Project scm_url beginning with a dash (e.g. '--upload-pack=<command>:x') is passed verbatim to git ls-remote without a -- separator, causing git to interpret it as an option and execute a shell command on the control-plane task pod. Only low privileges are required (a user able to create/modify a project in a single organization), yet the impact crosses tenant boundaries (S:C) and enables in-cluster lateral movement, which fully justifies the scope change and the C:H/I:H/A:H triad. No EPSS score, CISA KEV listing, or public POC is present in the provided data, so there is no public exploit identified at time of analysis and no confirmed active exploitation - the risk is driven by low exploitation complexity and a mechanically simple, well-understood argument-injection primitive rather than by observed in-the-wild activity. The one signal that conflicts with the true nature of the bug is the 'Information Disclosure' tag, which understates a command-execution/RCE-class issue. Overall: treat as a high-priority patch for any multi-tenant AAP deployment because a single low-privileged org user can pivot to full control-plane and cross-tenant compromise.

A low-privileged user with project-management rights in one organization creates or edits a Project and sets the SCM URL to a crafted value like '--upload-pack=touch /tmp/pwned;:x'. When automation-controller runs the project update, git ls-remote interprets the string as the --upload-pack option and executes the attacker's shell command on the shared control-plane task pod, with command output reflected back through the project update stdout endpoint. No public exploit code is identified at time of analysis, but the technique is trivial and reliable given the missing -- separator.