CVE-2026-84711
automation-controller: automation-controller: Project scm_branch/scm_refspec argument injection into git during project sync allows arbitrary file read on the sync host (control-plane ServiceAccount token, SECRET_KEY, and DB credentials on control-plane deployments) leading to full AAP and Kubernetes-namespace compromise
Severidad por fuente
La etiqueta propia de Trivy es CRITICAL. Crítica según Red Hat.
Descripción
A flaw was found in Red Hat Ansible Automation Platform's automation-controller. The Project SCM branch and SCM refspec fields are accepted without rejecting values that begin with a dash and are passed to the git module during project synchronization, where they reach a `git checkout`/`git fetch` command line as bare arguments with no end-of-options separator. An authenticated user permitted to create or edit a project can set the SCM branch to a git option such as `--pathspec-from-file=<path>`, causing git to read an arbitrary file on the synchronization host and reflect its contents back through the project-update output. Because project synchronization runs on the control-plane host on default OpenShift Operator deployments, an attacker can read the control-plane Kubernetes ServiceAccount token, the Controller SECRET_KEY, and the database credentials, leading to full compromise of the Automation Platform and its Kubernetes namespace. System administrator privileges are not required and the impact crosses tenants.
Paquetes afectados y versiones corregidas
Ninguna fuente de paquetes lista este ID.