Bug 2527123 (CVE-2026-84679)
| Summary: | CVE-2026-84679 automation-controller: automation-controller-container: automation-controller: the AWX_TASK_ENV setting applies arbitrary environment variables to the control-plane web and task processes, enabling TLS interception of external credentia ... | ||
|---|---|---|---|
| Product: | [Other] Security Response | Reporter: | Thomas Eagle <teagle> |
| Component: | vulnerability | Assignee: | Product Security <prodsec-ir-bot> |
| Status: | NEW --- | QA Contact: | |
| Severity: | high | Docs Contact: | |
| Priority: | high | ||
| Version: | unspecified | CC: | dschmidt, jlanda, kshier, security-response-team, simaishi, stcannon, teagle, yguenane |
| Target Milestone: | --- | Keywords: | Security |
| Target Release: | --- | ||
| Hardware: | All | ||
| OS: | Linux | ||
| Whiteboard: | |||
| Fixed In Version: | Doc Type: | --- | |
| Doc Text: |
A flaw was found in Red Hat Ansible Automation Platform's automation-
controller. The AWX_TASK_ENV setting accepts arbitrary environment variable
keys with no restriction, and its values are applied directly to the running
automation controller web and task processes rather than only to sandboxed
execution environments. A user with the system administrator role can set
variables such as REQUESTS_CA_BUNDLE, HTTPS_PROXY, SSLKEYLOGFILE, OPENSSL_CONF,
or LD_PRELOAD that reconfigure the control-plane process TLS trust store,
key-logging, OpenSSL engine, or dynamic linker. This enables silent interception
of the outbound TLS the control plane uses to fetch external secret-store
credentials and Red Hat subscription and Insights secrets, arbitrary file write
of TLS session keys, and potential native code execution in the control-plane
process, escalating an application administrator to compromise of the control
plane and all tenant secrets.
|
Story Points: | --- |
| Clone Of: | Environment: | ||
| Last Closed: | Type: | --- | |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
| Deadline: | 2026-10-01 | ||
|
Description
Thomas Eagle
2026-09-01 22:06:08 UTC
This issue has been addressed in the following products: Red Hat Ansible Automation Platform 2.6 for RHEL 10 Red Hat Ansible Automation Platform 2.6 for RHEL 9 Via RHSA-2026:71113 https://access.redhat.com/errata/RHSA-2026:71113 This issue has been addressed in the following products: Red Hat Ansible Automation Platform 2.5 for RHEL 9 Red Hat Ansible Automation Platform 2.5 for RHEL 8 Via RHSA-2026:71114 https://access.redhat.com/errata/RHSA-2026:71114 |