Ansible Automation Platform EUVD-2026-85638

Requires an authenticated privileged user (PR:H) who can create or edit a custom Credential Type in automation-controller, using both its environment-variable injector and its file injector. The specific weakness is that name validation (ANSIBLE_* prefix check plus a fixed ENV_BLOCKLIST) omits process-hijacking loader variables - BASH_ENV, ENV, LD_PRELOAD, LD_LIBRARY_PATH, PYTHONSTARTUP, GIT_SSH_COMMAND - so those pass the deny-list. Exploitation is further gated on a subsequent job actually attaching a credential of that malicious type, at which point the injected loader variable executes the planted script inside the execution-environment container. Limiting factors: high privilege needed to define credential types, and the code runs only when a job consumes the credential.

This is a genuine remote-code-execution flaw whose real-world priority is bounded by a high privilege requirement, not by the code path. The CVSS 3.1 vector (AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:H/A:N, 7.6) is internally consistent with the description: PR:H reflects that creating or modifying a custom Credential Type in AWX/automation-controller is a superuser/platform-admin operation, and S:C reflects the escape from the control-plane authorization boundary into the execution-environment container. The I:H (arbitrary code execution) is well justified; the vendor's choice of C:L/A:N is defensible but conservative, since code execution in the EE container plausibly exposes any credential attached to affected jobs. No EPSS score, no CISA KEV entry, and no public proof-of-concept were supplied, so this is not evidence of widespread or active exploitation - the signals point to a real-but-gated privilege-to-RCE escalation rather than a mass-exploitable internet-facing bug. The dominant limiting factor is PR:H: the attacker must already hold high privileges to define the credential type, which for many operators reduces this to an insider/lateral-movement and containment-boundary concern rather than an external attack surface. No conflicting signals between the vector and the description were found; the only notable data gaps are the absent fix version, EPSS, and POC status.

A privileged automation-controller user who can define a custom Credential Type crafts an env-var injector that sets BASH_ENV (or ENV/LD_PRELOAD/PYTHONSTARTUP/GIT_SSH_COMMAND) - names the deny-list fails to block - and uses the credential file injector to drop an attacker-controlled script into the execution environment. When any job attaches a credential of that type, the loader variable causes the script to run, yielding arbitrary code execution inside the execution-environment container. No public exploit identified at time of analysis; exploitation requires authenticated high-privilege access per the CVSS PR:H metric.