Argument Injection Vulnerability in Ansible Automation Platform

• •CVE-2026-84724 allows argument injection in Ansible Automation Platform.
• •Exploitation requires superuser privileges, but full remote code execution is not currently possible.
• •A fix involving validation and quoting has been proposed.

An argument-injection flaw (CVE-2026-84724) was identified in the Ansible Automation Platform's automation-controller system-job subsystem. This vulnerability allows authenticated users with superuser privileges to inject arbitrary arguments into the control-plane awx-manage process due to a lack of integer validation on a user-supplied variable. The flaw arises from the way the system-job template launch endpoint processes the 'days' variable, which is not validated properly before being flattened into a command string. While full remote code execution is not currently possible without additional conditions, the flaw enables control over the argument vector and module path. The vulnerability affects users of the Ansible Automation Platform, particularly those utilizing the automation-controller. A fix has been proposed that includes shlex-safe quoting and validation of the launch-time variables. The CVE was published on September 23, 2026, and is now included in the NVD dataset.