NVD-CVE-2026-84724

Nvd.Nist • September 23, 2026

Official websites use .gov A .gov website belongs to an official government organization in the United States.

Secure .gov websites use HTTPS A lock ( ) or https:// means you’ve safely connected to the .gov website. sensitive information only on official, secure websites.

CVE-2026-84724 Detail

The CVE has recently been published to the CVE List and is now included within the NVD dataset.

An argument-injection flaw was found in the Ansible Automation Platform automation-controller system-job subsystem. The system-job template launch endpoint stores a user-supplied "days" variable without running the integer validation defined elsewhere for that field, and the dispatcher flattens the management-command argument list into a single string with spaces before the job runner re-splits it, so spaces in the value become additional command-line arguments. Because system jobs are executed in-process on the control node without the container isolation applied to all other job types, an authenticated user with superuser privileges can inject arbitrary arguments — including Python's path option — into the control-plane awx-manage process, controlling its argument vector and the first entry of its module path. Full remote code execution requires an additional import gadget that is not present in the current management commands, so the demonstrated impact is argument injection with control of the process path rather than confirmed code execution.

References to Advisories, Solutions, and Tools

We hope your visit was informative.

We have provided a link to this site because it has information that may be of interest to our users. NIST does not necessarily endorse the views expressed or the facts presented on this site. Further, NIST does not endorse any commercial products that may be advertised or available on this site.

You will now be directed to:

We hope your visit was informative.

You will now be directed to:

We hope your visit was informative.

You will now be directed to:

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Argument Injection Vulnerability in Ansible Automation Platform An argument-injection flaw (CVE-2026-84724) was identified in the Ansible Automation Platform's automation-controller system-job subsystem. This vulnerability allows authenticated users with superuser privileges to inject arbitrary arguments into the control-plane awx-manage process due to a lack of integer validation on a user-supplied variable. The flaw arises from the way the system-job template launch endpoint processes the 'days' variable, which is not validated properly before being flattened into a command string. While full remote code execution is not currently possible without additional conditions, the flaw enables control over the argument vector and module path. The vulnerability affects users of the Ansible Automation Platform, particularly those utilizing the automation-controller. A fix has been proposed that includes shlex-safe quoting and validation of the launch-time variables. The CVE was published on September 23, 2026, and is now included in the NVD dataset. 2 sources 43

Extracted Entities

NVD-CVE-2026-84724

The full story

Extracted Entities

Attack Types (1)

Countries (1)

CVEs (1)

CWE Weaknesses (1)

Platforms (1)