Bug 2459131 (CVE-2026-6494)

Summary: CVE-2026-6494 aap-mcp-server: AAP MCP server: Log injection allows social engineering attacks via unsanitized input
Product: [Other] Security Response Reporter: OSIDB Bzimport <bzimport>
Component: vulnerabilityAssignee: Product Security DevOps Team <prodsec-dev>
Status: NEW --- QA Contact:
Severity: medium Docs Contact:
Priority: medium    
Version: unspecifiedCC: dschmidt, erezende, jlanda, jwong, kshier, omaciel, simaishi, smcdonal, stcannon, teagle, treeshateyou67, yguenane
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: ---
Doc Text:
A flaw was found in the AAP MCP server. An unauthenticated remote attacker can exploit a log injection vulnerability by sending specially crafted input to the `toolsetroute` parameter. This parameter is not properly sanitized before being written to logs, allowing the attacker to inject control characters such as newlines and ANSI escape sequences. This enables the attacker to obscure legitimate log entries and insert forged ones, which could facilitate social engineering attacks, potentially leading to an operator executing dangerous commands or visiting malicious URLs.
 Story Points: ---
Clone Of: Environment:
Last Closed: Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:

Description OSIDB Bzimport 2026-04-17 08:06:59 UTC 
The AAP MCP server is vulnerable to multiple forms of log injection because the :toolsetroute parameter is passed directly to console.log()without prior sanitization, validation, or neutralization of control characters. This vulnerability exists across all six toolset-specific endpoints (POST, GET, DELETE, and OPTIONS).  An unauthenticated remote attacker can inject payloads containing newlines (%0A), tabs (%09), and sophisticated ANSI escape sequences (e.g., \x1b[2J, \x1b[31m). While the server's logging mechanism is append-only, an attacker can use these characters to effectively hide previous legitimate log entries from an operator's view and replace them with fabricated, high-fidelity forged entries. 

This capability facilitates advanced social engineering attacks, where an operator might be tricked into executing dangerous commands or visiting malicious URLs in response to fabricated error messages.
Comment 2 Philip Kotler 2026-04-18 09:34:38 UTC 
I’ve also encountered this on Red Hat Ansible Automation Platform MCP server. Logs weren’t sanitizing input properly, which could allow misleading entries to be injected. https://access.redhat.com/security/cve/cve-2026-6494 https://trees-hateyou.io