CVE-2026-84714

/// Technical description

A flaw was found in the automation-controller input-validation

guard sanitize_jinja(). The function uses two regular

expressions to reject user-supplied Jinja, but the patterns

stop at the first interior '}' or '%' character, so a Jinja

expression containing an inner brace (for example an empty

dict) is accepted while remaining valid Jinja. Because

sanitize_jinja() is the sole guard on several launch-time

fields — ad-hoc command module_args, Machine-credential

username / become_method / become_user, and inventory host

names — a low-privileged user can inject Jinja that ansible-core

evaluates in the execution environment. This enables execution

of arbitrary commands in the execution environment (bypassing an

administrator's AD_HOC_COMMANDS module allowlist) and disclosure

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References