CVE-2026-84709
Description
A flaw was found in Red Hat Ansible Automation Platform's automation-controller. When a custom credential type is created or updated, the injector configuration is validated by rendering each attacker-supplied Jinja2 template synchronously inside the web request worker, with no limit on iteration count, output size, or execution time. An authenticated superuser can submit a credential type whose injector contains deeply nested loops or large string operations, consuming CPU and wall-clock time in the web worker until it is killed by the request timeout; issuing enough concurrent requests places all web workers into a kill-and-respawn loop, making the Controller API and UI unavailable for the duration of the attack. Additionally, certain template constructs raise exception types that the validator does not handle, resulting in an unhandled server error (HTTP 500) instead of a clean validation error. The rendering sandbox prevents code execution, so there is no confidentiality or integrity impact.
Statement
This flaw affects automation-controller as shipped in Red Hat Ansible Automation Platform. Exploitation requires an authenticated superuser, and the rendering sandbox prevents code execution, so there is no confidentiality or integrity impact; the impact is a denial of service of the Controller web tier while the attack is sustained, plus an unhandled server error. Red Hat rates this Moderate. The recommended fix is to validate injector templates by inspecting the parsed template (parse, do not render), or to bound rendering with a hard wall-clock/iteration/output limit and reject loop/extends/include/ import constructs, and to broaden exception handling so all failures surface as clean validation errors rather than HTTP 500.
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 4.9 | N/A | N/A |
| Attack Vector | Network | N/A | N/A |
| Attack Complexity | Low | N/A | N/A |
| Privileges Required | High | N/A | N/A |
| User Interaction | None | N/A | N/A |
| Scope | Unchanged | N/A | N/A |
| Confidentiality | None | N/A | N/A |
| Integrity Impact | None | N/A | N/A |
| Availability Impact | High | N/A | N/A |
Vector
Red Hat: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H
Understanding the Weakness (CWE)
Availability
Technical Impact: DoS: Resource Consumption (CPU); DoS: Resource Consumption (Memory); DoS: Resource Consumption (Other); Reduce Performance
This issue can make the product perform more slowly. If an attacker can influence the number of iterations in the loop, then this performance problem might allow a denial of service by consuming more platform resources than intended.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
