The vulnerability lies in the GALAXY_TASK_ENV setting of Red Hat Ansible Automation Platform’s automation‑controller. Values appended to this environment are not validated against dynamic‑linker or interpreter variables such as LD_PRELOAD and PYTHONPATH. A system administrator can assign these variables to reference a file inside a project checkout on the shared volume, which is then executed by the ansible‑galaxy commands during project updates. This allows arbitrary native or Python code execution within the control‑plane’s project synchronization environment and gives the attacker read and write access to all organizations’ project content. By manipulating Galaxy server tokens injected into the environment, the attacker can compromise the automation content supply chain across tenants.

Affected systems are deployments of Red Hat Ansible Automation Platform’s automation‑controller. The advisory does not specify affected versions; any instance that permits system administrators to modify GALAXY_TASK_ENV is vulnerable.

The flaw carries a CVSS score of 8.7, indicating high severity. EPSS is not available and the vulnerability is not listed in the CISA KEV catalog. The attack requires a user with system‑administrator privileges within the control plane, making the attack vector local privileged. Once exploited, it can lead to a cross‑tenant compromise of the automation content supply chain. Although the exploitation probability is currently uncertain, the high severity and privileged access requirement places this issue in the urgent risk category.